# CVE-2026-77271

mcp-atlassian arbitrary write allows module overwrite and remote code execution.

- Page: https://www.vulneraibility.com/cve/CVE-2026-77271
- CVSS: 8.3
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.60% (percentile 48.8)
- CISA SSVC: exploitation poc, automatable no, technical impact partial (assessed 2026-09-24)
- Weakness: CWE-22, CWE-94
- Also known as: GHSA-6vmq-24h2-pj7j, PYSEC-2026-4087
- Published: 2026-09-22

## Affected versions

- sooperset mcp-atlassian: affected < 0.22.0

A version outside these ranges is not a statement that it is unaffected.

## Impact

Attacker-controlled attachment write can overwrite Python modules in app working dir, leading to remote code execution when imported.

## Action

Immediate action required

## Recommendation

Upgrade mcp-atlassian to >=0.22.0 and restrict upload/base_dir usage

## References

- [other] https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-6vmq-24h2-pj7j
- [other] https://github.com/sooperset/mcp-atlassian/pull/1448
- [other] https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460
- [other] https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.