{
 "id": "AIR-2026-0177",
 "slug": "cve-2026-77270-arbitrary-file-disclosure-vulnerability-in-mc",
 "title": "CVE-2026-77270: Arbitrary file disclosure vulnerability in MCP Atlassian server",
 "summary": "An arbitrary file disclosure vulnerability exists in the MCP Atlassian server prior to version 0.22.0. The vulnerability allows callers with upload access to read and disclose local server files via unvalidated path inputs in attachment tools.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "MCP Atlassian"
 ],
 "incident_date": "2026-09-22",
 "incident_date_precision": "day",
 "first_reported": "2026-09-22",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77270",
   "publisher": "NVD",
   "title": "CVE-2026-77270: MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).",
   "published_at": "2026-09-22"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-77270",
  "mcp",
  "infravuln"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}