CVE-2026-73496
HighCVSS 7.7Summary
MCP Atlassian before 0.22.0 allows a client with write-tool access to pass file paths without confinement to the server, leading to disclosure of server files, Atlassian credentials, or another tenant's data.
Risk Assessment
In remote HTTP, SSE, or multi-user deployments, an attacker can read sensitive files and credentials, compromising confidentiality and potentially leading to privilege escalation.
Recommendation
Update MCP Atlassian to version 0.22.0 or later, which confines paths to an approved server workspace.
Other vulnerabilities in MCP Atlassian
See all- CVE-2026-73497Medium
In MCP Atlassian from 0.17.0 until 0.22.0, validate_url_for_ssrf resolves the attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url header host once at middleware time, but the outbound request uses the raw hostname and resolves it again without IP pinning. This enables DNS-rebinding attacks and unauthenticated requests to cloud metadata or internal services.
- CVE-2026-73498High
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment passes its client-supplied file_path directly to open(file_path, "rb") in src/mcp_atlassian/confluence/attachments.py through _upload_attachment_direct() without calling validate_safe_path. An authenticated MCP client can read any file accessible to the server process and exfiltrate it to Confluence as an attachment. If an AI agent can be induced to call the tool through untrusted content, the same flaw can disclose server environment variables such as CONFLUENCE_API_TOKEN and other credentials. This issue is fixed in version 0.22.0.
Original NVD description (English source)
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the confluence_upload_attachment and confluence_upload_attachments tools pass a client-controlled file_path through src/mcp_atlassian/confluence/attachments.py upload_attachment, and the jira_update_issue attachments parameter reaches src/mcp_atlassian/jira/attachments.py upload_attachment, without confining either path to an approved server workspace. In a remote HTTP, SSE, or multi-user deployment, absolute or traversing paths are resolved on the MCP server and uploaded to Atlassian, allowing a client with write-tool access to disclose server files, environment-held Atlassian credentials, or another tenant's data. A local single-user stdio deployment does not cross this trust boundary because the server runs in the caller's environment. This issue is fixed in version 0.22.0.