CVE-2026-73496: MCP Atlassian: Arbitrary server-side file read via attachment upload

Q: Which deployments are exposed to this issue?

Remote HTTP, SSE, and multi-user deployments are exposed when clients have access to the affected write tools. A local single-user stdio deployment does not cross the relevant trust boundary because the server runs in the caller's environment.

Q: What access does an attacker need?

An attacker needs access to write tools that can upload Confluence attachments or update Jira issue attachments. They can supply an absolute or traversal-based file path that the MCP server resolves on its own host.

Q: What could be disclosed through exploitation?

The attacker may cause server-side files to be uploaded to Atlassian. This can expose files containing environment-held Atlassian credentials or data belonging to another tenant.

Q: What version fixes the issue?

Version 0.22.0 fixes the issue. Versions prior to 0.22.0 are affected.

Published Sep 14, 2026

Updated

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the confluenceuploadattachment and confluenceuploadattachments tools pass a client-controlled filepath through src/mcpatlassian/confluence/attachments.py uploadattachment, and the jiraupdateissue attachments parameter reaches src/mcpatlassian/jira/attachments.py uploadattachment, without confining either path to an approved server workspace. In a remote HTTP, SSE, or multi-user deployment, absolute or traversing paths are resolved on the MCP server and uploaded to Atlassian, allowing a client with write-tool access to disclose server files, environment-held Atlassian credentials, or another tenant's data. A local single-user stdio deployment does not cross this trust boundary because the server runs in the caller's environment. This issue is fixed in version 0.22.0.

Affected Software

1 affected component

MCP Atlassian MCP Atlassian<0.22.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MCP Atlassian to a version that resolves this vulnerability.
Fixed in 0.22.0

Event History

Sep 14, 2026

CVE Published

via MITRE·07:49 PM

Data Sourced

via MITRE·07:49 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Remote HTTP, SSE, and multi-user deployments are exposed when clients have access to the affected write tools. A local single-user stdio deployment does not cross the relevant trust boundary because the server runs in the caller's environment.

What access does an attacker need?