CVE-2026-73498
MCP Atlassian
- Severity
- High
- Published
- August 12, 2026
- Last modified
- September 18, 2026
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment passes its client-supplied file_path directly to open(file_path, "rb") in src/mcp_atlassian/confluence/attachments.py through _upload_attachment_direct() without calling validate_safe_path. An authenticated MCP client can read any file accessible to the server process and exfiltrate it to Confluence as an attachment. If an AI agent can be induced to call the tool through untrusted content, the same flaw can disclose server environment variables such as CONFLUENCE_API_TOKEN and other credentials. This issue is fixed in version 0.22.0.
CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness
- CWE-22 Path traversal
References
Listed in
More MCP Atlassian CVEs
Validate_url_for_ssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL authentication flow.
The OAuth error query parameter is passed to CallbackHandler._send_response in oauth_setup.py and interpolated into an HTML page without escaping.
Validate_safe_path defaults its base directory to os.getcwd(), and affected Confluence attachment call sites omit base_dir, allowing attacker-selected writes within the working directory.
The Jira and Confluence attachment upload tools treat caller-controlled file_path values as trusted server-local paths.
The remediation for CVE-2026-27825 protects download destinations but does not constrain source paths used by attachment uploads.
The OAuth fallback token directory and JSON file are created without explicit owner-only modes.