Description
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, an HTTP transport deployment with READ_ONLY_MODE=false accepts a request without an Authorization identity and permits attacker-controlled Atlassian service headers, including X-Atlassian-Confluence-Url, to select a public attacker hostname or one allowed by MCP_ALLOWED_URL_DOMAINS. A caller can then invoke confluence_upload_attachment or the Jira attachment variant in src/mcp_atlassian/jira/attachments.py with a server-local file_path and cause the MCP process to send the file to the selected attachment endpoint. This issue is fixed in version 0.22.0.
Published: 2026-09-22
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Local File Exfiltration
Action: Immediate Patch
AI Analysis

Impact

The vulnerability permits an unauthenticated attacker to trigger the MCP server to transmit a local file to an arbitrary external destination by manipulating the attachment upload API. The attacker can set the target via the X-Atlassian-Confluence-Url header, without needing valid credentials. This enables local file exfiltration, potentially revealing sensitive data stored on the MCP host.

Affected Systems

Affected deployments include sooperset MCP Atlassian versions prior to 0.22.0, which are used by Atlassian Confluence and Jira. The issue is addressed in release 0.22.0.

Risk and Exploitability

Based on the description, the likely attack vector is a network request to the MCP HTTP transport endpoint. The CVSS score of 7.4 indicates a high severity. EPSS score is not available, and the vulnerability is not listed in CISA KEV. Reachability requires network access to the MCP HTTP transport endpoint and the ability to send a crafted request with specific headers. Once exploited, the attacker can exfiltrate any file accessible to the MCP process, leading to loss of confidentiality.

Generated by OpenCVE AI on September 22, 2026 at 21:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to MCP Atlassian version 0.22.0 or later.
  • If an upgrade is not immediately possible, disable or restrict the attachment upload functions to prevent use without authentication.
  • Configure the MCP server to operate in READ_ONLY_MODE=true until a fix is applied.
  • Limit the allowed values for the X-Atlassian-Confluence-Url header to trusted internal domains and block external hostnames.

Generated by OpenCVE AI on September 22, 2026 at 21:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-wv8v-v4c5-v75j MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path
History

Mon, 28 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Mcp-atlassian
Mcp-atlassian mcp Atlassian
CPEs cpe:2.3:a:mcp-atlassian:mcp_atlassian:*:*:*:*:*:*:*:*
Vendors & Products Mcp-atlassian
Mcp-atlassian mcp Atlassian

Fri, 25 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Sooperset
Sooperset mcp-atlassian
Vendors & Products Sooperset
Sooperset mcp-atlassian

Tue, 22 Sep 2026 19:00:00 +0000

Type Values Removed Values Added
Description MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, an HTTP transport deployment with READ_ONLY_MODE=false accepts a request without an Authorization identity and permits attacker-controlled Atlassian service headers, including X-Atlassian-Confluence-Url, to select a public attacker hostname or one allowed by MCP_ALLOWED_URL_DOMAINS. A caller can then invoke confluence_upload_attachment or the Jira attachment variant in src/mcp_atlassian/jira/attachments.py with a server-local file_path and cause the MCP process to send the file to the selected attachment endpoint. This issue is fixed in version 0.22.0.
Title MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path
Weaknesses CWE-200
CWE-22
CWE-441
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Mcp-atlassian Mcp Atlassian
Sooperset Mcp-atlassian
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-24T15:26:33.550Z

Reserved: 2026-08-20T19:02:23.416Z

Link: CVE-2026-77246

cve-icon Vulnrichment

Updated: 2026-09-24T15:26:08.279Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-22T19:16:48.730

Modified: 2026-09-28T14:31:10.220

Link: CVE-2026-77246

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T22:00:08Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-441

    Unintended Proxy or Intermediary ('Confused Deputy')