MCP Atlassian EUVD-2026-84741

Requires the mcp-atlassian server (prior to 0.22.0) to be running the HTTP-exposed 'streamable-http' transport, and the attacker to be an authenticated MCP caller (PR:L) with access to the Jira or Confluence upload_attachment tool and valid/shared Atlassian upload credentials. Given those, the caller-supplied file_path is passed to local file operations without workspace confinement (only os.path.abspath was applied), so traversal or absolute paths escape the intended directory. What LIMITS exploitation: the attacker must already possess tool access and working Atlassian credentials, the server must expose the HTTP transport rather than stdio-only, and exfiltration is bounded to files readable by the server process user. Not exploitable against a default stdio-only, non-shared-credential deployment.

The vendor-supplied CVSS 4.0 vector (8.3, AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H) is internally consistent with the description: a network-reachable, low-complexity arbitrary file read requiring only low-privilege authenticated tool access (PR:L), yielding high confidentiality impact with no integrity or availability effect. The SC:H (subsequent-system confidentiality) reflects that files read exceed the tool's intended authorization boundary and are exfiltrated to Atlassian. No EPSS score, no CISA KEV listing, and no public exploit code are present in the intelligence - this is 'no public exploit identified at time of analysis.' Real-world risk is moderate and gated: exploitation requires that the server run the HTTP (streamable-http) transport AND that the caller already hold MCP tool access with working Atlassian upload credentials, typically a shared-credential deployment. This is a genuine data-exfiltration flaw rather than a high-CVSS-but-low-real-risk paper cut, but it is not a mass-exploitation candidate: the affected product is a niche open-source MCP server with a small production footprint, and the pre-conditions limit the attacker population to already-permitted callers. Priority is elevated for the specific population running mcp-atlassian over HTTP with broad file-system access, and low for everyone else.

A remote MCP caller with tool access to an HTTP-exposed mcp-atlassian server invokes the Jira or Confluence upload_attachment tool but supplies a file_path pointing at a sensitive host file (e.g. /etc/passwd, ~/.ssh/id_rsa, or application secrets) instead of a workspace file. The server reads that file unrestricted and uploads it as an Atlassian attachment, which the attacker then reads back, exfiltrating arbitrary host-readable data. No public exploit code is identified, but the attack requires no special tooling beyond a crafted tool argument.