Executive brief
The mcp-atlassian MCP server allows remote attackers to read arbitrary files from the server's filesystem and exfiltrate them via fake Confluence uploads. Because the default deployment binds to all network interfaces with no authentication, any network-reachable attacker can exploit this without credentials. An attacker could steal sensitive files like credentials, private keys, or application secrets running under the server process.
Technical details
The `confluence_upload_attachment` MCP tool accepts a `file_path` parameter that is passed directly to `open(file_path, "rb")` without any path validation or sanitization (line 477 in attachments.py). This is a path traversal / arbitrary file read vulnerability (CWE-22). The attacker-controlled file path parameter reaches the open() sink end-to-end through the MCP tool handler, with no intermediate validation. The file contents are then streamed into a multipart upload directed at a Confluence host (which the attacker controls via environment configuration). In the default `streamable-http` transport, the server binds to 0.0.0.0 with no authentication, making this network-exploitable. This is an incomplete fix of a prior symmetric vulnerability (GHSA-xjgw-4wvw-rgm4) that patched the download/write path but missed the upload/read path. No patch is available at time of disclosure.
Affected products
- sooperset mcp-atlassian >= 0.17.0
Timeline
- 2026-09-22: disclosed: Vulnerability advisory published