A critical chained vulnerability tracked as CVE-2026-77248 and CVE-2026-77254 (CVSS score 8.6) in the open-source mcp-atlassian Model Context Protocol (MCP) server allows unauthenticated network attackers to read arbitrary files from host servers and exfiltrate them directly into Jira and Confluence instances.
The Rise of Model Context Protocol & Emerging Agent Surfaces
The Model Context Protocol (MCP), pioneered by Anthropic and rapidly adopted across enterprise AI workflows, provides a standardized RPC interface allowing LLMs and autonomous agents to query enterprise tools, databases, and issue trackers. Organizations routinely deploy MCP servers like mcp-atlassian to allow AI coding assistants (such as Claude Code, Cursor, and custom agentic frameworks) to read issue backlogs, fetch documentation, and update Jira tickets.
However, deploying MCP servers with network-accessible transports without rigorous transport-level authentication creates an immediate attack vector. In vulnerable configurations, MCP servers become "confused deputies," executing privileged file operations on behalf of unauthorized external callers.
Vulnerability Mechanics: Chained Auth Bypass and Path Traversal
The exploit chain combines two distinct software defects present in mcp-atlassian versions prior to 0.22.0:
1. Missing Authentication on Streamable HTTP Transport (CWE-306)
When started in HTTP transport mode (often binding to 0.0.0.0 in container environments), the server failed to validate Authorization bearer tokens. If an HTTP request arrived with no token, the server did not reject the request; instead, it fell back to executing the tool using the operator's globally provisioned Atlassian API token.
2. Unsanitized File Path Traversal in Attachment Tool (CWE-22)
The upload_attachment tool exposed by the MCP server accepted a user-supplied file_path argument. The handler passed this string directly to Python's built-in open() function without verifying that the target path remained confined to an allowed directory:
# Vulnerable handler in mcp-atlassian/tools.py
@mcp.tool()
async def upload_attachment(issue_key: str, file_path: str):
# Missing: path resolution and containment check
with open(file_path, "rb") as f:
data = f.read()
# Exfiltrates host file as a Jira attachment using operator credentials
jira_client.add_attachment(issue=issue_key, attachment=data)
By invoking the upload_attachment tool remotely, an attacker can specify sensitive system paths such as /etc/shadow, /proc/self/environ, or cloud credentials stored in ~/.aws/credentials. The server reads the file and attaches it to a publicly accessible Jira ticket specified by the attacker, achieving clean out-of-band exfiltration.
Vulnerability Profile & Impact Matrix
| Characteristic | Vulnerability Specification |
|---|---|
| Tracking Identifiers | CVE-2026-77248 (Chained Path Traversal) / CVE-2026-77254 (Missing Auth) |
| Common Weakness | CWE-306: Missing Authentication / CWE-22: Path Traversal |
| CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (Score: 8.6 High) |
| Affected Software | mcp-atlassian prior to version 0.22.0 |
| Remediated Version | mcp-atlassian version 0.22.0 and later |
| Attack Vector | Unauthenticated JSON-RPC payload over streamable HTTP transport |
Defensive Playbook: Hardening Enterprise MCP Deployments
Organizations deploying AI tool servers must enforce strict identity and filesystem sandboxing controls:
1. Upgrade mcp-atlassian to Version 0.22.0+
Update the package via pip or Docker image:
# Python environment upgrade
pip install --upgrade mcp-atlassian>=0.22.0
# Verify installed version
python3 -c "import mcp_atlassian; print(mcp_atlassian.__version__)"2. Bind MCP Transports Strictly to Localhost
Unless an identity-aware proxy is configured, never bind MCP HTTP transports to 0.0.0.0. Enforce loopback binding (127.0.0.1) or standard stdio transport:
# Command-line invocation enforcing local loopback
mcp-atlassian --transport sse --host 127.0.0.1 --port 80003. Enforce Principle of Least Privilege in Container Runtimes
Run MCP server containers with read-only root filesystems and minimal directory mounts, preventing the server process from accessing host secrets:
# Docker execution with read-only root filesystem
docker run --read-only --cap-drop=ALL --security-opt=no-new-privileges -v /safe/workspace:/workspace:ro mcp-atlassian:v0.22.0
