Executive brief
The Atlassian MCP Server (used to connect AI agents to Confluence and Jira) allows attackers to read any file accessible to the server process—such as SSH keys, environment files, or cloud credentials—by uploading them as attachments. An attacker can either inject malicious commands into Jira/Confluence pages that an agent reads, or directly call the vulnerable tool if the HTTP endpoint is exposed. This enables credential theft and complete compromise of cloud accounts and systems the server has access to.
Technical details
This is an arbitrary file read vulnerability in the `upload_attachment` tool for both Confluence and Jira. The vulnerable code in `src/mcp_atlassian/confluence/attachments.py` (lines 62–78, 477) and `src/mcp_atlassian/jira/attachments.py` (lines 374–386) accepts a user-supplied `file_path` parameter and opens it with `open(file_path, "rb")` without validating that the path is within a safe base directory. Although `os.path.abspath()` is called, it does not restrict paths to a safe root; an attacker can supply absolute paths like `/etc/shadow`, `/root/.ssh/id_rsa`, or `~/.aws/credentials`. The symmetric download paths were patched for CVE-2026-27825 with `validate_safe_path()`, but the upload paths were overlooked. An unauthenticated attacker reaching a non-loopback HTTP endpoint, or a threat actor injecting prompts into Jira/Confluence pages that an LLM agent reads, can trigger file exfiltration. The fix is to wrap `file_path` through `validate_safe_path()` with a configured upload base directory before opening the file.
Affected products
- Atlassian MCP Server main branch as of 2026-04-21
Timeline
- 2026-09-22: disclosed: GHSA-f4p7-qx46-wc5j published