MCP Atlassian EUVD-2026-120865

Requires a remote multi-user transport (streamable-http or SSE, e.g. 'uvx mcp-atlassian --transport streamable-http') AND the server process must have been started from a wide working directory: a systemd system unit without WorkingDirectory= (cwd '/'), a systemd user unit (cwd $HOME), or a shell/uvx launch inheriting a broad cwd. The attacker must be an authenticated remote MCP caller able to invoke confluence_upload_attachment (consistent with PR:L). Limiting factors that reduce real-world exposure: the official Docker image is NOT affected (pinned WORKDIR /app keeps the guard effective), local stdio desktop usage is intended behavior and not a vulnerability, and containerized orchestration from the official image is protected. The unauthenticated position is only restored if the operator additionally sets ALLOW_GLOBAL_CRED_FALLBACK=true on a wide-cwd host.

Signals point to a low-to-moderate real-world priority with one notable internal conflict. The vendor-assigned CVSS 4.0 base score is 2.1 (low) with PR:L (authenticated) and only VC:L confidentiality impact, and the vuln.today decision label is 'monitor' - consistent with a non-urgent issue. However, the GHSA advisory (GHSA-qh7q-jmc7-rc7j) describes the concrete impact as arbitrary file read of sensitive host files (/etc/passwd, /proc/self/environ containing Atlassian API tokens, .env files, SSH keys) exfiltrated to the attacker's Confluence - which is materially higher than the VC:L the CVSS vector claims; treat the assigned confidentiality metric as likely understated versus the advisory's own impact narrative. Exploitation is gated: it only works on remote HTTP/SSE multi-user deployments where the server process starts from a wide working directory, so the low CVSS partly reflects that deployment dependency rather than a benign bug. No KEV listing and no EPSS score are present in the input, and exploitation is not confirmed in the wild. The PoC is a reference in the advisory, not verified working exploit code. Net: patch within a normal maintenance cycle; it is not an emergency, but operators running non-containerized remote deployments should prioritize it above its raw 2.1 score because the real impact is arbitrary file read of secrets.

On a remote streamable-http/SSE deployment of mcp-atlassian started from a wide working directory (e.g., a systemd system unit with cwd '/'), an authenticated MCP caller invokes the confluence_upload_attachment tool with file_path set to an absolute host path such as /proc/self/environ or an .env file. Because validate_safe_path confines the source only to the process CWD, every absolute path passes when the CWD is the filesystem root, so the server reads the file and uploads its contents to the caller's own Confluence instance. A public PoC reference exists in the GHSA advisory (end-to-end reproduction described), but it is not verified as working exploit code in the input.