Mcp Atlassian
Monthly
Arbitrary file read via path traversal in mcp-atlassian prior to 0.22.0 allows any authenticated MCP client to supply an absolute or traversal path to the confluence_upload_attachment tool, causing the server to open and exfiltrate the targeted file as a Confluence attachment. On Linux deployments, /proc/self/environ exposes live API credentials including CONFLUENCE_API_TOKEN, AWS keys, and database passwords, enabling full Atlassian account takeover and lateral movement. A confirmed prompt injection attack chain means threat actors who can write content an AI agent will read - such as a malicious Jira ticket - can trigger the same credential exfiltration with zero MCP credentials; publicly available exploit code and a demonstration video exist.
Arbitrary file read via path traversal in mcp-atlassian prior to 0.22.0 allows any authenticated MCP client to supply an absolute or traversal path to the confluence_upload_attachment tool, causing the server to open and exfiltrate the targeted file as a Confluence attachment. On Linux deployments, /proc/self/environ exposes live API credentials including CONFLUENCE_API_TOKEN, AWS keys, and database passwords, enabling full Atlassian account takeover and lateral movement. A confirmed prompt injection attack chain means threat actors who can write content an AI agent will read - such as a malicious Jira ticket - can trigger the same credential exfiltration with zero MCP credentials; publicly available exploit code and a demonstration video exist.