EUVD-2026-84771
GHSA-wv8v-v4c5-v75j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HTTP-mode MCP endpoint unauthenticated
-
DeliveryInject X-Atlassian-Confluence-Url header to attacker host
-
ExploitInvoke upload_attachment with server-local file_path
-
ExecutionMCP reads unvalidated path (no validate_safe_path)
-
ImpactFile exfiltrated to attacker endpoint
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the server deployed in HTTP transport mode (streamable-http or sse) with READ_ONLY_MODE=false; in that mode a request lacking an Authorization identity but carrying service headers (X-Atlassian-Confluence-Url / X-Atlassian-Confluence-Personal-Token) is accepted and user_atlassian_auth_type is set to 'pat', bypassing authentication. The attacker-selected hostname must be a public attacker host or one permitted by MCP_ALLOWED_URL_DOMAINS (SSRF filter only blocks localhost, RFC1918, and some metadata hosts). Limiting factors: the default/local stdio transport is not exposed to this; READ_ONLY_MODE=true blocks the write-path tool; and only files readable by the MCP process user can be exfiltrated. Versions < 0.22.0 only. |
| Impact | Signals are moderately concerning but not screaming priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) describes a remote, unauthenticated, low-complexity attack with high confidentiality impact and a scope change - consistent with the GHSA advisory's claim that no Authorization header is required in HTTP transport mode. Publicly available exploit code exists (confirmed via a live Docker-based PoC in the advisory), which raises practical risk. However, EPSS is low at 0.30% (23rd percentile), indicating no signal of broad automated exploitation, and the CVE is NOT on CISA KEV, so there is no confirmed active exploitation. A critical qualifier tempers the raw score: exploitation is gated on a specific NON-DEFAULT deployment posture - HTTP transport mode (streamable-http or sse) with READ_ONLY_MODE=false. Many real deployments run the stdio transport (typical for local IDE/agent integrations), which is not exposed to remote header-injection. Net: a genuine confidentiality flaw with a working PoC, but real-world urgency is bounded by the deployment condition and the low EPSS - treat as a real priority only for HTTP-exposed instances, otherwise moderate. |
| Exploit ScenarioDerived | An organization runs mcp-atlassian in HTTP transport mode (streamable-http/sse) with READ_ONLY_MODE=false and no enforced Authorization identity. A remote attacker sends a request with attacker-controlled X-Atlassian-Confluence-Url (pointing at their own public host or an MCP_ALLOWED_URL_DOMAINS-permitted host) and invokes confluence_upload_attachment (or the Jira variant) with file_path=/etc/passwd, ~/.env, SSH keys, or cloud credentials, causing the MCP process to read and POST that file to the attacker's endpoint. A live Docker-based proof-of-concept is publicly documented in the GHSA advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 28, 2026
Unauthenticated server-local file exfiltration in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows a remote caller to read any file accessible to the MCP process and have it uploaded to an attacker-controlled endpoint. The issue affects only deployments running the HTTP transports (streamable-http or sse) with READ_ONLY_MODE=false, where a request that carries X-Atlassian-Confluence-Url and X-Atlassian-Confluence-Personal-Token but no Authorization header is accepted as a 'pat' identity, so the attacker-chosen Atlassian URL is used to build the attachment client and the confluence_upload_attachment (or Jira attachment) tool accepts an arbitrary server-side file_path. CVSS 3.1 rates it 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) with confidentiality-only impact, a public Docker-based proof of concept was confirmed by the reporter so publicly available exploit code exists, and EPSS is low at 0.30% (23rd percentile) with no confirmed actively exploited (CISA KEV) status; version 0.22.0 fixes the flaw.
Earlier versions of this analysis (1)
An unauthenticated remote attacker can coerce an HTTP-transport deployment of the MCP Atlassian server (sooperset/mcp-atlassian, all versions prior to 0.22.0) into exfiltrating server-local files by abusing a caller-supplied file_path together with attacker-controlled Atlassian service headers such as X-Atlassian-Confluence-Url. When the server runs with READ_ONLY_MODE=false and the header points to a public host or one permitted by MCP_ALLOWED_URL_DOMAINS, invoking confluence_upload_attachment (or the Jira attachment variant) causes the MCP process to read the referenced local file and transmit it to the attacker's chosen attachment endpoint. Impact is limited to confidentiality of files readable by the MCP process user; no public exploit code has been identified at time of analysis, and exploitation is blocked entirely on stdio deployments, in read-only mode, or where the destination allowlist is restricted to trusted hosts.
RemediationAI
Upgrade to MCP Atlassian 0.22.0 (vendor-released patch: 0.22.0), which confines upload sources with validate_safe_path(), adds SSRF redirect validation and DNS pinning in the Confluence client, and refuses downloads into the working-directory root; the fix is visible in PR https://github.com/sooperset/mcp-atlassian/pull/1448 and commit b041733473f95119dd539542a43c280737a8e460, with the advisory at https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-wv8v-v4c5-v75j. If immediate upgrade is not possible, the highest-value compensating control is to stop exposing the HTTP transports: run the server over stdio (the default) so the header-based identity path is unreachable, at the cost of losing shared multi-client deployment. Alternatively set READ_ONLY_MODE=true, which removes the upload write-path tools entirely but also disables all legitimate write operations. Where HTTP transport is mandatory, terminate it behind a reverse proxy that strips any client-supplied X-Atlassian-* headers and injects only trusted values, require and enforce a real Authorization identity, and configure MCP_ALLOWED_URL_DOMAINS to a strict allowlist containing no attacker-reachable or Docker-internal hostnames - noting that none of these fully closes the arbitrary file_path read on their own. Finally, run the MCP process as an unprivileged account with no access to SSH keys, .env files, or cloud credential stores, and restrict its filesystem view (container read-only root or a dedicated mount namespace) to limit what any residual path-traversal read could expose.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MCP Atlassian is a Python Model Context Protocol server that brokers Confluence and Jira operations to MCP clients, and it can be run over stdio or over HTTP transports (streamable-http/sse) so that many clients share one process. In the vulnerable design the HTTP middleware in src/mcp_atlassian/servers/main.py extracts X-Atlassian-Confluence-Url and X-Atlassian-Confluence-Personal-Token from inbound request headers and, when no Authorization header is present, sets user_atlassian_auth_type to 'pat' - effectively a header-driven authentication/identity bypass (CVSS PR:N confirms no credentials are needed). The attacker-supplied URL is then validated by validate_url_for_ssrf in src/mcp_atlassian/utils/urls.py, which only blocks localhost, RFC 1918 ranges and a small set of cloud metadata hostnames, so a public attacker hostname or any host permitted by MCP_ALLOWED_URL_DOMAINS passes; that URL is injected as url= into ConfluenceConfig in src/mcp_atlassian/servers/dependencies.py, constructing a fetcher pointed at the attacker's server. The tool argument file_path is forwarded unsanitized from src/mcp_atlassian/servers/confluence.py into confluence_fetcher.upload_attachment(); in src/mcp_atlassian/confluence/attachments.py the path is converted with os.path.abspath() and only checked for existence - validate_safe_path(), which is already applied to download paths, is never called - before the file is opened and sent. This is the CWE-22 path-traversal/arbitrary-file-read class compounded with SSRF-style URL redirection: the server is induced to read a local file outside any permitted directory and transmit it to a destination the caller controls. A similar code path exists for Jira attachments in src/mcp_atlassian/jira/attachments.py. The upstream fix adds validate_safe_path() confinement to the upload source, an SSRF redirect validation hook plus a DNS-pinning adapter (to close the validate-then-reconnect TOCTOU/rebinding window) in the Confluence client, a refusal to write downloads into the CWD root, and an always-ANDed spaces allowlist in search.
Know when Mcp Atlassian gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
HTTP-mode header bypass means no auth (PR:N), network low-complexity; arbitrary server-local file read exfiltrated off-host gives C:H with scope change (S:C), no integrity/availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, an HTTP transport deployment with READ_ONLY_MODE=false accepts a request without an Authorization identity and permits attacker-controlled Atlassian service headers, including X-Atlassian-Confluence-Url, to select a public attacker hostname or one allowed by MCP_ALLOWED_URL_DOMAINS. A caller can then invoke confluence_upload_attachment or the Jira attachment variant in src/mcp_atlassian/jira/attachments.py with a server-local file_path and cause the MCP process to send the file to the selected attachment endpoint. This issue is fixed in version 0.22.0.
Technical POC Analysis
CWE-22 (path traversal), assigned by the CVE; the advisory's own PoC header labels it CWE-200.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
MCP Atlassian (sooperset/mcp-atlassian) deployments exposed over HTTP transports are vulnerable to unauthenticated remote file exfiltration, allowing an outside caller to read any file the MCP process can access - including stored Atlassian credentials and configuration data - and send it to an attacker-controlled endpoint. Only installations running the streamable-http or sse transports with READ_ONLY_MODE disabled are exposed, so leadership should prioritize inventorying those network- or internet-reachable instances, since stolen secrets could be used to pivot into the organization's Atlassian environment. Publicly available exploit code exists, though there is no confirmed active exploitation at this time.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Mcp Atlassian
View allServer-side request forgery in MCP Atlassian (the Model Context Protocol server for Confluence and Jira) prior to 0.22.0
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 applies its ENABLED_TOOLS and TOOLSETS least-privilege filters onl
Path traversal in MCP Atlassian releases prior to 0.22.0 lets a caller of the confluence_upload_attachment MCP tool read
Unauthenticated arbitrary file read in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 lets a remote network calle
Arbitrary local file read leading to data exfiltration affects sooperset's MCP Atlassian server (mcp-atlassian) prior to
Server-side request forgery in MCP Atlassian prior to 0.22.0 lets an attacker who controls or has already compromised th
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 lets a low-privileged authenticated MCP caller write attacker-chos
Server-side request forgery in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows a low-privileged authenticat
Arbitrary local file read in MCP Atlassian (mcp-atlassian) prior to 0.22.0 allows an authenticated MCP caller who can re
Arbitrary server-local file read and exfiltration in MCP Atlassian (sooperset/mcp-atlassian) prior to 0.22.0 lets an aut
Path traversal in the MCP Atlassian server (mcp-atlassian) prior to 0.22.0 allows an authenticated MCP client to read fi
Information disclosure in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows an authenticated caller of the MC
Exploit-DB