CVE-2026-77257 MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, HTTP-exposed Jira and Confluence upload tools pass a caller-provided filepath to local file operations without restricting it to the workspace. A remote MCP caller with tool access ca...

CVE-2026-77257

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to arbitrary file path traversal in its HTTP-exposed upload tools prior to version 0.22.0 . The root cause is that the server passes a caller-provided file_path to local file operations without restricting acces...

CVE-2026-77257 MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, HTTP-exposed Jira and Confluence upload tools pass a caller-provided filepath to local file operations without restricting it to the workspace. A remote MCP caller with tool access ca...

EUVD-2026-84741

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, HTTP-exposed Jira and Confluence upload tools pass a caller-provided filepath to local file operations without restricting it to the workspace. A remote MCP caller with tool access ca...

CVE-2026-77257 MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, HTTP-exposed Jira and Confluence upload tools pass a caller-provided filepath to local file operations without restricting it to the workspace. A remote MCP caller with tool access ca...

EUVD-2026-84607

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher construction falls back to the operator's globally configured Jira or Confluence credential...

PT-2026-96949

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description HTTP-exposed Jira and Confluence upload tools allow a remote caller to provide a file path that is passed to local file operations without being restricted to a specific workspace. This allows...

CVE-2026-77257: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, HTTP-exposed Jira and Confluence upload tools pass a caller-provided filepath to local file operations without restricting it to the workspace. A remote MCP caller with tool access ca...

PT-2026-96951

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions 0.17.0 through 0.21.0 Description A path traversal issue exists in the confluence upload attachment tool. The file path variable is passed directly to the open function without proper validation, allowing a caller to rea...

PT-2026-96943

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description In multi-user HTTP deployments using the --transport streamable-http configuration, the server exposes all tools to unauthenticated network clients. This occurs because the UserTokenMiddleware...

CVE-2026-77248: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while uploadattachment accepts an unrestricted filepath. An...

PT-2026-96946

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description Requests to the HTTP MCP endpoint without a per-user identity can reach tool handlers that utilize globally configured Jira or Confluence credentials. This allows a network caller to perform...

RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

Summary An unauthenticated remote attacker can leak one entry per HTTP request out of the in-memory session table of LocalSessionManager by sending a well-formed JSON-RPC POST that is not an InitializeRequest. The Streamable HTTP server's handlepost allocates the session before it validates the...

GHSA-9PJ6-VHGR-3MWH RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

Summary An unauthenticated remote attacker can leak one entry per HTTP request out of the in-memory session table of LocalSessionManager by sending a well-formed JSON-RPC POST that is not an InitializeRequest. The Streamable HTTP server's handlepost allocates the session before it validates the...

CVE-2026-63128

A flaw was found in rmcp, a Rust SDK for the Model Context Protocol. An unauthenticated remote attacker can send specially crafted JSON-RPC POST requests to the stateful Streamable HTTP server. These requests cause the server to create and permanently retain session and channel state without prop...

CVE-2026-63128 RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in crates/rmcp/src/transport/streamablehttpserver/tower.rs allows an unauthenticated client to send a well-formed JSON-RPC POST that is not an initialization request, or a...

CVE-2026-63128 RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in crates/rmcp/src/transport/streamablehttpserver/tower.rs allows an unauthenticated client to send a well-formed JSON-RPC POST that is not an initialization request, or a...

CVE-2026-63128

RMCP , the official Rust SDK for the Model Context Protocol, has an unauthenticated denial-of-service vulnerability in its stateful Streamable HTTP server (crates/rmcp/src/transport/streamable_http_server/tower.rs). Prior to version 2.0.0 , StreamableHttpService::handle_post calls LocalSessionMan...

PT-2026-93789

Name of the Vulnerable Software and Affected Versions rmcp versions prior to 2.0.0 Description The stateful Streamable HTTP server in the rmcp crate contains a memory leak that can lead to a Denial of Service. An unauthenticated remote attacker can exploit this by sending a well-formed JSON-RPC...

Characterizing Network Centralization and Observability in the Remote MCP Ecosystem

The Model Context Protocol MCP has emerged as the dominant interface for connecting autonomous agents to external data sources and execution environments. The ecosystem's transition from local process execution to remote Streamable HTTP deployments introduces unmeasured architectural and security...