{
 "id": "AIR-2026-0175",
 "slug": "cve-2026-77257-mcp-atlassian-remote-local-file-read-and-uplo",
 "title": "CVE-2026-77257: MCP Atlassian remote local file read and upload vulnerability",
 "summary": "HTTP-exposed Jira and Confluence upload tools in MCP Atlassian prior to 0.22.0 lack proper workspace restrictions on file paths. Remote callers can exploit this to read sensitive local files and attach them to pages.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "mcp-atlassian"
 ],
 "incident_date": "2026-09-22",
 "incident_date_precision": "day",
 "first_reported": "2026-09-22",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77257",
   "publisher": "NVD",
   "title": "CVE-2026-77257: MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).",
   "published_at": "2026-09-22"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-77257",
  "mcp",
  "atlassian"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}