{
 "id": "AIR-2026-0166",
 "slug": "cve-2026-77248-unauthenticated-file-read-and-exfiltration-in",
 "title": "CVE-2026-77248: Unauthenticated file read and exfiltration in MCP Atlassian",
 "summary": "An unauthenticated remote caller can exploit transport weaknesses and unrestricted file paths in MCP Atlassian prior to 0.22.0 to read and exfiltrate host files. The vulnerability was disclosed with available patches.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "MCP Atlassian"
 ],
 "incident_date": "2026-09-22",
 "incident_date_precision": "day",
 "first_reported": "2026-09-22",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77248",
   "publisher": "NVD",
   "title": "CVE-2026-77248: MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).",
   "published_at": "2026-09-22"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-77248",
  "unauthenticated-access",
  "file-disclosure",
  "mcp"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}