CVE-2026-73496: MCP Atlassian Path Traversal Vulnerability

CVE-2026-73496 Overview

CVE-2026-73496 is a path traversal vulnerability [CWE-22] in MCP Atlassian, a Model Context Protocol (MCP) server that bridges AI clients to Atlassian Confluence and Jira. Versions prior to 0.22.0 accept a client-controlled file_path in the confluence_upload_attachment, confluence_upload_attachments, and jira_update_issue tools without confining the path to an approved server workspace. Remote HTTP, Server-Sent Events (SSE), and multi-user deployments resolve absolute or traversing paths on the MCP server and upload the resulting file to Atlassian. An authenticated client with write-tool access can exfiltrate server files, environment-held Atlassian credentials, or another tenant's data.

Critical Impact
Authenticated remote clients can read arbitrary files from the MCP server host and exfiltrate them into attacker-controlled Atlassian issues or pages.

Affected Products

MCP Atlassian versions prior to 0.22.0
Deployments exposing the server over HTTP or SSE transports
Multi-user MCP Atlassian tenants sharing a single server process

Discovery Timeline

2026-09-14 - CVE-2026-73496 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73496

Vulnerability Analysis

The flaw resides in the attachment upload paths of MCP Atlassian. In src/mcp_atlassian/confluence/attachments.py, the upload_attachment function accepts a file_path value supplied by the MCP client. The previous implementation converted relative paths to absolute paths using os.path.abspath and then opened the file for upload. No validation confined the resolved path to a designated workspace directory.

The same issue affects src/mcp_atlassian/jira/attachments.py, which is reached through the attachments parameter of the jira_update_issue tool. Because the MCP server process runs with its own file system privileges and holds Atlassian API credentials in environment variables, a caller can request any file readable by the server account. The file is then uploaded to a Confluence page or Jira issue that the caller controls, completing the exfiltration.

Local single-user stdio deployments do not cross a trust boundary. The server runs inside the caller's own process context, so there is no elevation of access. Remote HTTP, SSE, and multi-tenant deployments do cross that boundary and are exposed.

Root Cause

The attachment tools trusted client-supplied file paths without applying a workspace confinement check. Absolute paths, .. traversal sequences, and symbolic links were resolved directly against the server's file system.

Attack Vector

An authenticated MCP client with write-tool access sends an upload request specifying a sensitive path such as /etc/passwd, /proc/self/environ, or ~/.config/mcp-atlassian/.env. The server reads the file and uploads it as an attachment to an Atlassian resource the attacker can read.

python

            return {"success": False, "error": "No file path provided"}

        try:
-            # Convert to absolute path if relative
-            if not os.path.isabs(file_path):
-                file_path = os.path.abspath(file_path)
+            # Confine the upload source to the workspace before it is read: reject
+            # traversal/absolute paths that escape CWD (arbitrary file read /
+            # exfiltration via a caller-supplied file_path).
+            file_path = str(validate_safe_path(file_path))

            # Check if file exists
            if not os.path.exists(file_path):

Source: GitHub Commit b041733. The patch replaces os.path.abspath with a validate_safe_path helper that rejects paths escaping the current working directory.

Detection Methods for CVE-2026-73496

Indicators of Compromise

Confluence or Jira attachments whose original filenames contain absolute paths, .. sequences, or system file names such as passwd, shadow, id_rsa, or .env.
MCP Atlassian server logs showing upload_attachment calls with file_path values outside the configured workspace directory.
Outbound HTTPS uploads from the MCP server host referencing Atlassian API endpoints immediately after unusual file read events.

Detection Strategies

Review Atlassian audit logs for attachments created by service accounts tied to MCP Atlassian and correlate filenames against expected workspace paths.
Enable file access auditing on the MCP server host for sensitive locations such as /etc, /root, and application configuration directories.
Inspect newly uploaded attachments for content resembling environment files, private keys, or credential material.

Monitoring Recommendations

Alert on any MCP Atlassian tool invocation where the file_path argument is absolute or contains ...
Track version strings reported by MCP Atlassian instances to identify hosts still running releases earlier than 0.22.0.
Monitor egress from MCP server hosts to Atlassian tenants that do not match the intended tenant scope.

How to Mitigate CVE-2026-73496

Immediate Actions Required

Upgrade MCP Atlassian to version 0.22.0 or later on every remote or multi-user deployment.
Rotate any Atlassian API tokens, OAuth secrets, and adjacent credentials that were readable by the MCP server process.
Audit Confluence and Jira attachments created since deployment for files sourced outside the intended workspace.

Patch Information

The fix ships in MCP Atlassian v0.22.0 through Pull Request #1448. It introduces a validate_safe_path helper that confines uploads to the configured workspace. Additional context is available in GHSA-wm45-qh3g-v83f.

Workarounds

Restrict MCP Atlassian to local stdio deployments until the upgrade is applied, since the trust boundary is not crossed in single-user mode.
Run the MCP server as an unprivileged user inside a container or chroot, with read access limited to a dedicated attachment workspace.
Remove Atlassian credentials from process environment variables and inject them through a secrets broker that the server cannot read as a file.

bash

# Upgrade to the patched release
pip install --upgrade "mcp-atlassian>=0.22.0"

# Verify installed version
python -c "import importlib.metadata; print(importlib.metadata.version('mcp-atlassian'))"