EUVD-2026-57639
GHSA-g5r6-gv6m-f5jv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
PR:L reflects required MCP authentication for the direct path; S:C captures credential exfiltration impacting the downstream Atlassian tenant; no integrity or availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment passes its client-supplied file_path directly to open(file_path, "rb") in src/mcp_atlassian/confluence/attachments.py through _upload_attachment_direct() without calling validate_safe_path. An authenticated MCP client can read any file accessible to the server process and exfiltrate it to Confluence as an attachment. If an AI agent can be induced to call the tool through untrusted content, the same flaw can disclose server environment variables such as CONFLUENCE_API_TOKEN and other credentials. This issue is fixed in version 0.22.0.
AnalysisAI
Arbitrary file read via path traversal in mcp-atlassian prior to 0.22.0 allows any authenticated MCP client to supply an absolute or traversal path to the confluence_upload_attachment tool, causing the server to open and exfiltrate the targeted file as a Confluence attachment. On Linux deployments, /proc/self/environ exposes live API credentials including CONFLUENCE_API_TOKEN, AWS keys, and database passwords, enabling full Atlassian account takeover and lateral movement. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Direct exploitation requires authenticated MCP client access (PR:L, CVSS-confirmed) and the ability to call the confluence_upload_attachment tool with an attacker-controlled file_path value; the target file must be readable by the server process UID. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.7 (High) with Changed Scope (S:C) accurately reflects that the confidentiality impact extends beyond the compromised server to the Atlassian tenant and any connected systems whose credentials were stored in the process environment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A publicly available PoC and demonstration video exist confirming exploitation. In the direct path, an authenticated MCP client calls confluence_upload_attachment with file_path set to /proc/self/environ; the server opens the file without any path check and uploads it as a Confluence attachment containing live API credentials. … |
| Remediation | Upgrade to mcp-atlassian 0.22.0 immediately; the patched release is available at https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0 and the fix is in commit b041733473f95119dd539542a43c280737a8e460. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all mcp-atlassian deployments and review access logs for confluence_upload_attachment tool usage; retrieve /proc/self/environ from each Linux instance to determine what credentials may be exposed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today