CVE-2026-73496

mcp-atlassian, an open-source Model Context Protocol (MCP) server for Atlassian Confluence and Jira, versions before 0.22.0 accepts a client-controlled file_path in the confluence_upload_attachment, confluence_upload_attachments, and jira_update_issue (attachments) tools without confining it to an approved server workspace (CWE-22/CWE-73). In remote HTTP, SSE, or other multi-user deployments, a client with access to these write tools can supply absolute or traversal paths that are resolved on the MCP server host, so arbitrary server files are read and uploaded to Atlassian Cloud/Data Center — effectively exfiltrating them through the attacker's own Atlassian instance. Successful abuse can disclose sensitive server files, the server's environment-held Atlassian API credentials/tokens, or another tenant's data, matching the CVSS 3.1 score of 7.7 (AV:N/AC:L/PR:L/S:C/C:H). Local single-user stdio deployments (e.g., Claude Desktop) do not cross the trust boundary, since the server runs in the caller's own environment, and are not affected. The issue is fixed in version 0.22.0; no public proof of concept or known in-the-wild exploitation exists as of this writing.

What to do: Upgrade mcp-atlassian to version 0.22.0 or later, which confines upload paths to an approved server workspace. If immediate upgrade is not possible, disable or restrict the confluence_upload_attachment, confluence_upload_attachments, and jira_update_issue write tools on any HTTP/SSE deployment and require strong authentication on remote endpoints (local stdio setups are not exposed). Review server logs and recent Confluence/Jira attachment history for uploads whose filenames or content indicate paths outside the workspace, and rotate the Atlassian API credentials held in the server environment if abuse is suspected.