Local File Exposure Vulnerability in MCP Atlassian for Confluence and Jira

CVE-2026-77257

What is CVE-2026-77257?

The MCP Atlassian, a Model Context Protocol server utilized by Atlassian products such as Confluence and Jira, is susceptible to a local file exposure issue. Prior to version 0.22.0, the HTTP-exposed upload tools allowed attackers with tool access to manipulate the file_path parameter, enabling them to execute local file operations without adequate restrictions. This vulnerability can potentially allow a remote attacker to read sensitive files on the server and upload those as attachments within Atlassian products. The flaw has been traced through specific code paths, and it has been effectively addressed in version 0.22.0.

References