CVE-2026-73496
Received Received - Intake

Path Traversal in MCP Atlassian Server

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the confluence_upload_attachment and confluence_upload_attachments tools pass a client-controlled file_path through src/mcp_atlassian/confluence/attachments.py upload_attachment, and the jira_update_issue attachments parameter reaches src/mcp_atlassian/jira/attachments.py upload_attachment, without confining either path to an approved server workspace. In a remote HTTP, SSE, or multi-user deployment, absolute or traversing paths are resolved on the MCP server and uploaded to Atlassian, allowing a client with write-tool access to disclose server files, environment-held Atlassian credentials, or another tenant's data. A local single-user stdio deployment does not cross this trust boundary because the server runs in the caller's environment. This issue is fixed in version 0.22.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-73496
EUVD
EUVD-2026-77795

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
atlassian mcp to 0.22.0 (exc)
atlassian confluence to 0.22.0 (exc)
atlassian jira to 0.22.0 (exc)
sooperset mcp-atlassian 0.22.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects MCP Atlassian, a Model Context Protocol server for Atlassian products like Confluence and Jira. Prior to version 0.22.0, tools like confluence_upload_attachment and jira_update_issue do not restrict file paths provided by clients. This allows attackers with write-tool access to upload files to arbitrary server locations, potentially exposing sensitive data such as server files or Atlassian credentials.

Detection Guidance

Check MCP Atlassian server version with 'pip show mcp-atlassian'. If version is below 0.22.0, the system is vulnerable. Inspect server logs for unusual file upload paths or unauthorized access attempts to sensitive files.

Impact Analysis

An attacker could exploit this to read sensitive files on the server, steal Atlassian credentials stored in the environment, or access data belonging to other tenants in multi-user deployments. This could lead to data breaches, unauthorized access, or further compromise of the system.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade MCP Atlassian to version 0.22.0 or later immediately. Restrict write-tool access to trusted clients only. Review and audit server file system permissions to limit exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73496. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart