CVE-2026-77271 is a high severity (CVSS 8.8) path traversal flaw in MCP Atlassian, the Model Context Protocol server for Jira and Confluence. In versions before 0.22.0 the attachment download guard allows writes anywhere under the working directory, which can overwrite Python modules. The fix is 0.22.0.
What's affected
MCP Atlassian in every version before 0.22.0. Fixed in 0.22.0. The advisory says versions from 0.17.0 onward are not fully patched against the earlier path traversal advisory (GHSA-xjgw-4wvw-rgm4), and the record says this one bypasses the remediation tracked as CVE-2026-27825.
Severity note: the record scores this 8.8 (high). The GitHub advisory lists the severity as high but showed no numeric score on the page we fetched, so the 8.8 comes from the record.
The advisory's prerequisites are Confluence credentials with write access to at least one page and network access to the server's HTTP port.
How to check if you're exposed
MCP Atlassian is a Python package, so the installed version is the thing to read. In the environment that runs the server, check it with pip.
pip show mcp-atlassian
pip list | grep -i mcp-atlassian
If you run it through uvx or a container image, look at the pinned tag in your launch command, compose file or deployment manifest. Anything below 0.22.0 is in range. Also note which authentication modes you use and whether the server is reachable over HTTP by clients you do not fully trust, because the advisories tie each issue to specific entry points.
Also check the working directory of the process. The advisory notes container deployments commonly run from the application directory, which is exactly where the Python source lives.
What to do now
- Upgrade mcp-atlassian to 0.22.0 or later. The maintainers fixed all four related issues in that release (see the release notes and pull request 1448).
- Redeploy every place that runs the server: local developer setups, shared containers and any agent platform that bundles it. Confirm the new version with pip show afterward.
- Run the server as a low-privilege user with a read-only application directory, and give it a separate writable folder for downloads, so a file write cannot replace code.
- Rotate any Atlassian tokens and cloud credentials that this server could reach if you have logs suggesting it contacted unexpected internal addresses.
Why it matters
This is CWE-22, path traversal, which here chains into CWE-94, code injection. The path guard checked that a target stayed inside a base directory, but when no base was passed it defaulted to the process working directory. Two Confluence attachment call sites passed none. In a container, the working directory holds the application's own modules, so those files counted as allowed targets.
Overwriting a module is serious because the next import runs the attacker's file. The advisory says code execution follows on the next process restart. That is a good example of why a safe default matters: a guard that quietly picks a broad base is a guard that is easy to bypass. The record does not flag this as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why does a file write become code execution?
Python loads module files when the process starts or imports them. If an attacker can replace one, the new contents run with the server's privileges.
Does a read-only filesystem fully protect me?
It blocks the module overwrite path described, but upgrade anyway because the guard itself was wrong.
Sources
Last reviewed: 18 October 2026.
