{
 "id": "AIR-2026-0173",
 "slug": "cve-2026-77259-mcp-atlassian-local-file-disclosure-via-attac",
 "title": "CVE-2026-77259: MCP Atlassian local file disclosure via attachment upload",
 "summary": "A path traversal and arbitrary file read vulnerability in MCP Atlassian prior to 0.22.0 lets callers upload environment files or credentials to Confluence. The issue stems from insufficient path validation in confluence_upload_attachment.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "mcp-atlassian"
 ],
 "incident_date": "2026-09-22",
 "incident_date_precision": "day",
 "first_reported": "2026-09-22",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77259",
   "publisher": "NVD",
   "title": "CVE-2026-77259: MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).",
   "published_at": "2026-09-22"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-77259",
  "mcp",
  "atlassian"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}