CVE-2026-77259: falha de alta gravidade em sooperset mcp-atlassian
MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.7epss 0.4%
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment opens a caller-selected server-local file without checking that the resolved path remains in the workspace. A caller can upload environment files, credentials, or other readable host data to a Confluence page and retrieve it through Atlassian. The advisory traces the vulnerable input and processing flow through confluence_upload_attachment, file_path, and open(file_path, "rb"), which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
sooperset · mcp-atlassianCVEs relacionadas — sooperset mcp-atlassian
No mesmo produto, das mais perigosas para as menos.
CVE-2026-27826HIGHMCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headersEPSS 13.9%CVE-2026-27825CRITICALMCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachmentEPSS 12.3%CVE-2026-77254CRITICALMCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentialsEPSS 0.6%CVE-2026-77271HIGHMCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)EPSS 0.6%CVE-2026-77262HIGHMCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)EPSS 0.6%CVE-2026-77243HIGHMCP Atlassian: ENABLED_TOOLS / Toolset authorization bypassEPSS 0.5%