MCP Atlassian EUVD-2026-84746

Requires an attacker able to invoke the MCP server's Jira update_issue tool (a permitted MCP caller) against a deployment of sooperset/mcp-atlassian prior to 0.22.0 that is configured with operator/shared Atlassian credentials. The caller must control the attachments argument, which is converted to local file paths and passed to upload_attachment without workspace confinement. Limiting factors: exploitation is bounded to files readable by the MCP server process and yields confidentiality impact only (arbitrary local file read/exfiltration, no write or code execution via this flaw); it is not exploitable against a properly isolated caller lacking Jira write/update tool access. Despite the vendor's PR:N vector, realistic exploitation depends on the shared-credential MCP deployment model rather than fully anonymous access.

This is a genuine but access-gated confidentiality issue, not a widespread-exploitation priority. The vendor CVSS 8.6 rests on PR:N and S:C, but that overstates realistic risk: the description and the PR#1448 code path (jira update_issue → attachments → upload_attachment → file_path) show the attacker must be a permitted MCP caller with rights to invoke Jira update_issue against a server holding operator Atlassian credentials, so effective privilege is PR:L (permitted caller / shared-credential deployment), consistent with the sibling upload_attachment file-read CVEs in the same batch (CVE-2026-77260, CVE-2026-77270). The scope change (S:C) is defensible as a confused-deputy pattern where the server exfiltrates its own host's files, but S:U is equally arguable. Impact is confidentiality-only (C:H, I:N, A:N) - arbitrary local file read, no code execution on its own (the RCE-via-CWD-overwrite concern is a separate flaw, GHSA-6vmq, patched in the same PR). No EPSS score, no CISA KEV entry, and no public POC are present in the input, so exploitation status is: no public exploit identified at time of analysis. Net: a real least-privilege/tenant-isolation weakness worth patching in any shared-credential MCP deployment, but far from a mass-exploitation, high-EPSS event given the niche product footprint and the required caller access.

An attacker who already has authorized access to invoke the MCP server's Jira update_issue tool supplies a file path such as /etc/passwd or a credentials/config file in the attachments argument. The server, running with operator Atlassian credentials, reads that arbitrary local file and uploads it as an attachment to a Jira issue, from which the attacker retrieves the contents - a confused-deputy exfiltration. No public exploit code is identified, though the fixing PR#1448 diff and advisory precisely trace the vulnerable path.