Executive brief
mcp-atlassian is a Model Context Protocol server that integrates Jira and Confluence with AI agents. When deployed as an HTTP service (documented as first-class), the Confluence and Jira attachment upload tools accept arbitrary server-local file paths without validation, allowing authenticated users or prompt-injected agents to read and exfiltrate any file the server process can access—including environment variables, API tokens, and service secrets. In containerized deployments with mounted credentials, this enables disclosure of sensitive operator-managed secrets.
Technical details
This is a path-traversal / arbitrary file read vulnerability in the upload-source validation logic. The vulnerability exists in two code paths: `src/mcp_atlassian/confluence/attachments.py:62-80,477` (Confluence) and `src/mcp_atlassian/jira/attachments.py:372-389` (Jira). Both accept caller-supplied file paths, convert relative paths to absolute without containment, verify file existence, and read the file for multipart upload to Atlassian—all without applying `validate_safe_path` containment checks. The codebase already implements `validate_safe_path` for download-destination paths to prevent writes outside a base directory, but this same check is omitted on the upload-source side. Attack vector is network (HTTP/SSE transport) with authentication; precondition is HTTP deployment exposure and write-tool access. An attacker can read any file accessible to the MCP process, including `.env` files with credentials and service secrets. Patch is pending; mitigation is to require `READ_ONLY_MODE=true` or disable HTTP upload tools.
Affected products
- sooperset mcp-atlassian all versions prior to patch
Timeline
- 2026-09-22: disclosed: Advisory GHSA-mrq8-fv7v-hhjg published
- 2026-05-05: advisory: Vulnerability discovery date