MCP Atlassian CVE-2026-77258

Requires the attacker to be an authenticated/permitted Confluence MCP caller (PR:L) with access to the upload_attachment tool of an MCP Atlassian server prior to 0.22.0. Exploitation is most impactful in shared-credential or multi-tenant deployments where the MCP caller is less privileged than the server process and can therefore reach files the caller should not see. No user interaction is needed (UI:N). The limiting factor is caller authorization - an isolated single-user deployment where the caller already owns the host filesystem gains little. Impact is confined to disclosure of any file readable by the server process; there is no write/integrity or availability impact.

Moderate real-world priority. The vendor CVSS of 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) is driven by network reachability, low complexity, and a scope change to High confidentiality - but the PR:L requirement is the key limiter: the attacker must already be a permitted Confluence MCP caller. There is no EPSS score, no CISA KEV listing, and no public POC, so this is 'no public exploit identified at time of analysis' rather than an actively exploited threat. The S:C (scope change) is defensible because the disclosed data is arbitrary server-local files readable by the MCP process (beyond the Atlassian data the caller is authorized for), but it is arguable - a conservative assessment could rate S:U with the same C:H, which would lower the score toward 6.5. This is a genuine confidentiality issue in shared-credential/multi-tenant MCP deployments, not an inflated high-CVSS-low-risk item, but its impact is bounded to file exfiltration (no I/A) and gated on caller privilege, so it is a patch-soon rather than patch-now emergency. No conflicting signals across sources; the source-code diff (PR#1448 adding validate_safe_path) directly corroborates the described root cause.

A user or automated agent granted access to a shared MCP Atlassian server (e.g. a low-privilege tenant on a multi-tenant deployment) invokes the upload_attachment tool with a crafted file_path such as '/etc/passwd', '../../.env', or an absolute path to service credentials on the server host. The tool opens that server-local file without confining it to the workspace, uploads it as a Confluence page attachment, and the attacker then downloads the attachment back to exfiltrate any data readable by the server process. No public exploit code exists, but exploitation is trivial for any permitted caller given AC:L.