CVE-2026-77259: MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

The earlier advisory GHSA-xjgw-4wvw-rgm4 hardened the download path with validate_safe_path(). The upload side in AttachmentsMixin.upload_attachment() was left alone: line 477 builds files = {"file": (filename, open(file_path, "rb"))} from the caller-supplied path. The tool layer in servers/confluence.py passes file_path through unchanged.

The reporter copied ~/.aws/credentials to a decoy filename, called the tool against a page they could edit, then downloaded the attachment from live Confluence Cloud. The raw credentials were intact. On Linux, a call with /proc/self/environ returns every runtime secret in one go.

The attacker needs an MCP client session and edit access to one page. On shared or Docker deployments, the server environment can hold every user's API tokens. Stolen Atlassian tokens keep working independently of MCP, so they survive shutting the server down or patching it. That is why rotating tokens matters after upgrading.

mcp-atlassian below 0.22.0. The reporter tested 0.21.1 against Confluence Cloud. Shared or Docker deployments, where the process environment holds several users' tokens, are the worst case.

pip show mcp-atlassian

Upgrade to 0.22.0:

pip install --upgrade mcp-atlassian==0.22.0

The reporter proposed validating the path in upload_attachment(), upload_attachments() and the Jira attachments module; the release carries the project's fix (pull request 1448). Because leaked tokens stay valid after patching, rotate the Atlassian API tokens and any other secret in the server's environment if you suspect abuse.

Look for Confluence attachments with odd file types, such as an image extension on a file that holds text, uploaded by the MCP account. Review attachment history on pages where the account has edit rights. In MCP logs, search confluence_upload_attachment calls with file_path values like /proc/self/environ, .aws/credentials or other absolute paths. Also check Atlassian token usage for unfamiliar IP addresses. Beam records agent MCP tool calls, which helps when an agent issued the upload.

Summary

Missing path validation in confluence_upload_attachment allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, /proc/self/environ yields all runtime secrets in a single call.

---

Details

AttachmentsMixin.upload_attachment() in src/mcp_atlassian/confluence/attachments.py opens the caller-supplied file_path with no boundary check:

# line 477
files = {"file": (filename, open(file_path, "rb"))}

The download path was correctly hardened in GHSA-xjgw-4wvw-rgm4 via validate_safe_path() (lines 223, 272). That fix was not applied to the upload path, leaving it completely unguarded. The MCP tool layer (servers/confluence.py:1295) passes file_path verbatim with no additional sanitization.

---

PoC

# 1. Prepare target file (macOS demo; on Linux use /proc/self/environ directly)
cp ~/.aws/credentials /tmp/diagram.png

# 2. Call the MCP tool
confluence_upload_attachment(
    content_id = "<any page attacker can edit>",
    file_path  = "/tmp/diagram.png"
)

# 3. Download attachment from Confluence — contains raw credentials

Tested on mcp-atlassian 0.21.1 against live Confluence Cloud. Attachment confirmed uploaded and retrieved with full credential content intact.

---

Impact

Any MCP client with edit access to one Confluence page can read arbitrary files from the server process. On shared/Docker deployments, /proc/self/environ exposes all users' API tokens in a single request. Exfiltrated Atlassian tokens provide persistent API access independent of MCP, surviving server shutdown or patching.

Incomplete fix of GHSA-xjgw-4wvw-rgm4 — arbitrary file read on upload mirrors the arbitrary file write on download fixed in that advisory.

---

Suggested Fix

# src/mcp_atlassian/confluence/attachments.py — upload_attachment()
# Add after abspath conversion, before open():

try:
    validate_safe_path(file_path)
except ValueError as e:
    return {"success": False, "error": str(e)}

Same fix required in upload_attachments() and src/mcp_atlassian/jira/attachments.py.