Six critical flaws disclosed in mcp-atlassian MCP server

Six security advisories for the Python package mcp-atlassian were published on 22 September 2026, covering arbitrary file reads, a server-side request forgery gap, world-readable OAuth token files, reflected cross-site scripting and an incomplete path traversal fix that the reporter says allows remote code execution. The package is a Model Context Protocol server, the component that lets an AI assistant call Jira and Confluence as tools.

Two advisories, tracked as CVE-2026-77270 and CVE-2026-77259, describe the same underlying problem: the attachment upload functions for both Confluence and Jira open any file path the caller supplies without checking it. According to the advisories, the project already ships a validate_safe_path helper and uses it correctly on downloads, but never calls it on uploads. An authenticated client can therefore ask the server to upload /etc/passwd, an .env file or SSH keys to a Confluence page or Jira issue and then read them back. One advisory notes that on Linux, reading /proc/self/environ returns every runtime secret in a single call, and that on shared or Docker deployments this exposes all users' API tokens. Both were tested against mcp-atlassian 0.21.1, one of them against live Confluence Cloud.

The advisories also flag a prompt injection route. A malicious Jira issue or Confluence page could simply instruct the assistant to upload a named file "for review". If the assistant follows the instruction, the file leaves the server.

CVE-2026-77271 concerns a fix that did not go far enough. The path traversal protection added in version 0.17.0 defaults its base directory to the process working directory. In a typical container that directory is the application directory, so the check accepts writes to the application's own Python source files. The reporter demonstrated overwriting a module and having the payload execute on the next process restart, and says versions 0.17.0 through 0.21.0 remain exposed despite the earlier advisory. The advisory adds that the MCP HTTP server binds to all interfaces with no authentication by default.

CVE-2026-77261 describes an SSRF protection that is attached to only one of three authentication branches. According to the advisory, the redirect-checking hook is applied for header personal access tokens but omitted for basic auth and OAuth, which cover most production Atlassian Cloud deployments. A controlled or compromised Atlassian instance could return a redirect to a cloud metadata address such as 169.254.169.254 and the session would follow it. The suggested fix is one line per branch.

CVE-2026-77268 covers OAuth token storage. The fallback token file, written alongside keyring storage, is created with default permissions, typically world-readable, and contains access tokens, refresh tokens and the cloud ID in plain text. Any other local user can read it and keep generating fresh tokens using the refresh token.

CVE-2026-77272 is a reflected cross-site scripting flaw in the OAuth setup wizard's callback server, which echoes the error query parameter into HTML without escaping. The advisory notes the server binds to all interfaces and waits up to five minutes for a callback, so anyone who can reach the victim's machine on port 8080 during setup can trigger script execution in the browser.

Each advisory includes a suggested patch. The records list the issues as reported.