Executive brief
Atlassian's Model Context Protocol (MCP) server for Jira contains a file read vulnerability that allows an AI agent to extract sensitive files and credentials from the host system. By crafting malicious file paths in the update_issue tool, an attacker can bypass sandbox restrictions and steal environment variables, API tokens, SSH keys, and configuration files—escalating from a restricted AI context to full system compromise.
Technical details
The vulnerability is a Confused Deputy attack in the MCP server's update_issue tool handler. The attachments parameter accepts file paths without sanitization, allowing absolute paths (starting with /), directory traversal sequences (../), and access to protected system files. The MCP server typically runs with higher privileges and broader filesystem access than the restricted AI agent, enabling it to read files the agent itself cannot access—such as /proc/self/environ (containing JIRA_API_TOKEN and other secrets) and host configuration files. An unauthenticated AI agent can invoke update_issue with arbitrary file paths, causing the privileged MCP process to read and attach those files to a Jira ticket, resulting in credential and configuration exfiltration. No input validation or path restriction is performed before the Jira API upload.
Affected products
- Atlassian MCP Server <UNKNOWN>
Timeline
- 2026-09-22: disclosed: Vulnerability advisory published