# MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport

Unauthenticated streamable-http clients of mcp-atlassian reach upload_attachment, whose unsanitized file_path reads arbitrary host files like /proc/self/environ, leaking the operator's Atlassian token.

- Payout: Research
- Severity: high
- Program: mcp-atlassian
- Found by: koonnamchok
- Disclosed: 2026-09-22
- CVE: CVE-2026-77248
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-cc5h-2pwp-pvcc
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-cc5h-2pwp-pvcc
- Tags: area:ai domain:ai impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:python technique:chained technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure vuln:path-traversal vuln:secrets-leak

**Target:** MCP server (streamable-http transport) upload_attachment tool
**Root cause:** streamable-http transport defaults to auth=None and falls back to the operator's global Atlassian credentials for requests with no Authorization header; upload_attachment passes attacker-controlled file_path straight into open(file_path,'rb') with no path validation.
**Steps:**
1. Deploy/observe default `--transport streamable-http` instance (binds 0.0.0.0, OAuth proxy disabled by default).
2. Send `tools/call upload_attachment { "file_path": "/proc/self/environ", "page_id": "<attacker-chosen>" }` with no Authorization header.
3. Read the uploaded bytes back via `tools/call download_attachment { ... }` (base64) to obtain the operator's ATLASSIAN token and .env secrets.
**How found:** Code review of the auth middleware: noticed _parse_auth_header only sets auth_validation_error on malformed headers, so absent Authorization passes through to the global credential fallback; then traced upload_attachment's file_path into open() and contrasted with the hardened download flow.
**Exploitation:** Unauthenticated network attacker calls upload_attachment with an arbitrary local path; the server opens the file as the operator and uploads it to an attacker-chosen Confluence page or Jira issue, which the attacker then downloads to exfiltrate secrets. Same unauthenticated path also grants use of all read/write Atlassian tools as the operator principal.
**Escalation:** Chained missing transport auth with the path-traversal sink; leaked operator Atlassian API token grants the operator's (often admin) Atlassian access beyond the MCP host.
**Insight:** In MCP servers, check whether auth middleware treats a *missing* header differently from a malformed one — absence often falls through to operator/global credentials. Also diff sibling tools: if download was hardened with validate_safe_path after a prior CVE, the upload counterpart usually wasn't.