GovKM
Source-Object Authority in MCP Actions

The Agent Was Allowed to Attach a File. Not Every File.

CVE-2026-77255 shows how an agent can be validly authorized to perform an action while lacking authority over the specific source object the action consumes.
Published:
September 28, 2026
|
5
min read
|
Governance Architecture
|
Series:
Case Study
Governance illustration representing an MCP server authorized to attach a file to Jira but induced to read and upload a different local file outside the intended workspace.
Expand image

Permission to perform an action does not imply authority over every object that action can reach.

CVE-2026-77255 affected mcp-atlassian before version 0.22.0. The Jira update tool accepted attachment paths without adequately validating that they belonged to an authorized workspace. A caller could therefore induce the MCP server to read arbitrary local files and attach them to a Jira issue, using the server as a confused deputy.

The continuity failure

The system preserved authorization for the operation type—attach a file—but lost authorization for the specific source object.

The GovKM interpretation

Every consequential action needs at least three independently valid relationships: Authorized Action + Authorized Source Object + Authorized Destination. A valid operation does not confer source authority by default.

Continuity path: Source / workspace file → Authority / file-access scope → Context / Jira attachment action → Decision → Action / upload → Record / Jira issue.

Source

GitHub Security Advisory GHSA-2xj6-xx86-cwwc and OSV CVE-2026-77255, September 22, 2026.

RELATED FRAMEWORK DOMAINS

Explore the Connected Framework

Continue through the framework domains connected to this article.

FRAMEWORK DOMAIN

Information Continuity

Keep information trustworthy, accessible, and connected regardless of the technology used to create or manage it.

FRAMEWORK DOMAIN

Records Governance

Govern records as authoritative evidence supporting accountability, compliance, and organizational continuity.

RELATED CORE PRINCIPLES

Principles Applied in This Article

Explore the core principles connected to this article.

CORE PRINCIPLE

Grounded Trust

Maintain authority, evidence, provenance, and governance so organizational knowledge remains reliable and explainable.

CORE PRINCIPLE

Contextual Understanding

Preserve the relationships and context that allow organizational knowledge to retain meaning across time and change.

CORE PRINCIPLE

Relationship Governance

Connect and govern information, authority, evidence, context, decisions, actions, records, and institutional memory as one continuity architecture.

RELATED TOPOLOGY ELEMENTS

Follow the Continuity Relationships

Explore the continuity topology elements connected to this article.

CONTINUITY TOPOLOGY

Source

The originating person, system, record, event, or environment from which information enters institutional use.

CONTINUITY TOPOLOGY

Evidence

The verifiable material that supports, qualifies, challenges, or constrains an institutional claim.

CONTINUITY TOPOLOGY

Authority

The institutional standing that determines whether information, interpretation, or action is recognized as valid or permitted.

CONTINUITY TOPOLOGY

Context

The circumstances, relationships, constraints, and meaning required to interpret information correctly for a specific institutional purpose.

CONTINUITY TOPOLOGY

Decision

The governed selection, judgment, or determination made from available evidence, authority, and context.

CONTINUITY TOPOLOGY

Action

The execution, intervention, communication, or operational change performed in response to a decision or authorized objective.

CONTINUITY TOPOLOGY

Record

The durable institutional evidence of information, decisions, actions, transactions, and their governing relationships.

CONTINUITY TOPOLOGY

Institutional Memory

The governed body of retained knowledge and relationships through which an institution can understand and reconstruct its prior experience.

CONTINUITY TOPOLOGY

Future Reuse

The responsible application of preserved institutional knowledge to future analysis, decisions, actions, and learning.

RELATED KNOWLEDGE

Continue Exploring

Explore related research, framework domains, and continuity concepts.
CONTINUE WITH THE FRAMEWORK

Explore the continuity relationships that support trustworthy organizational intelligence.

Continue through the GovKM Framework to examine the doctrine, knowledge, and implementation guidance behind Organizational Continuity.
Explore the Continuity FrameworkView All Articles