CVE-2026-73498: MCP Atlassian Path Traversal Vulnerability

CVE-2026-73498 Overview

CVE-2026-73498 is a path traversal vulnerability [CWE-22] in MCP Atlassian, a Model Context Protocol (MCP) server for Atlassian Confluence and Jira. Versions prior to 0.22.0 pass a client-supplied file_path directly to open(file_path, "rb") inside _upload_attachment_direct() without invoking validate_safe_path. An authenticated MCP client can read any file accessible to the server process and exfiltrate it to Confluence as an attachment. If an AI agent is induced to call the tool via untrusted content, the same flaw can leak server environment variables such as CONFLUENCE_API_TOKEN and other credentials.

Critical Impact
Authenticated attackers or prompt-injected AI agents can read arbitrary files from the MCP server host and exfiltrate them as Confluence attachments, exposing credentials and secrets.

Affected Products

MCP Atlassian (sooperset/mcp-atlassian) versions prior to 0.22.0
Deployments exposing the confluence_upload_attachment tool to MCP clients
AI agent workflows integrating MCP Atlassian with untrusted content sources

Discovery Timeline

2026-08-12 - CVE-2026-73498 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73498

Vulnerability Analysis

The flaw resides in src/mcp_atlassian/confluence/attachments.py. The _upload_attachment_direct() helper accepts a file_path argument from the MCP client and forwards it to Python's built-in open() in binary read mode. The pre-patch code only converted relative paths to absolute paths using os.path.abspath(). It performed no allowlist check and no confinement to the workspace directory.

An authenticated MCP client can supply arbitrary absolute paths such as /etc/passwd, /proc/self/environ, or ~/.aws/credentials. The server opens the file with its own process privileges and uploads the contents to Confluence as an attachment. The attacker then downloads the attachment through normal Confluence workflows.

The attack surface expands sharply in agentic AI deployments. A prompt injection embedded in a Jira ticket, Confluence page, or external document can instruct the AI agent to call confluence_upload_attachment with a sensitive path. This turns the vulnerability into a credential exfiltration primitive against the MCP server host itself.

Root Cause

The root cause is missing input validation on a filesystem path parameter received across a trust boundary. The validate_safe_path helper existed in the codebase but was not invoked in the direct-upload path. This is a classic [CWE-22] path traversal defect combined with an implicit trust of MCP client input.

Attack Vector

Exploitation requires network access to the MCP server and low-privileged authentication as an MCP client. No user interaction is required. The scope changes because files owned by the server process, including secrets outside the caller's normal authorization scope, become readable.

python

# Vulnerable behavior (pre-0.22.0) versus patched behavior in
# src/mcp_atlassian/confluence/attachments.py

# Before: caller-supplied path is used directly
# if not os.path.isabs(file_path):
#     file_path = os.path.abspath(file_path)

# After: confine the upload source to the workspace before it is read;
# reject traversal or absolute paths that escape CWD.
file_path = str(validate_safe_path(file_path))

# Check if file exists
if not os.path.exists(file_path):
    return {"success": False, "error": "File not found"}

Source: GitHub Commit b041733

Detection Methods for CVE-2026-73498

Indicators of Compromise

Confluence attachments containing filesystem artifacts such as passwd, shadow, environ, .env, or id_rsa
MCP server logs showing confluence_upload_attachment calls with absolute paths outside the intended workspace directory
Confluence audit events uploading attachments with unusually small sizes or MIME types inconsistent with user-generated content
Outbound Confluence API traffic from the MCP host immediately following ingestion of untrusted Jira or Confluence content

Detection Strategies

Inspect MCP request logs for file_path arguments containing .., absolute paths, or references to system directories like /etc, /proc, /root, or user home directories
Alert on Confluence attachment uploads whose filenames match known secret file patterns
Correlate AI agent tool-call traces with attachment upload events to detect prompt-injection-driven exfiltration

Monitoring Recommendations

Enable verbose logging on the MCP Atlassian server and forward events to a centralized SIEM for pattern matching
Monitor process-level file access on the MCP host for reads of sensitive paths by the MCP service account
Review Confluence attachment histories on spaces reachable by MCP integrations after upgrading

How to Mitigate CVE-2026-73498

Immediate Actions Required

Upgrade MCP Atlassian to version 0.22.0 or later, which enforces validate_safe_path on the upload path
Rotate any credentials that may have been exposed to the MCP server process, including CONFLUENCE_API_TOKEN and cloud provider secrets
Restrict MCP client authentication to trusted principals only and remove untrusted callers pending remediation
Audit Confluence spaces used by MCP integrations for attachments created during the exposure window

Patch Information

The fix is available in MCP Atlassian v0.22.0. The patch is documented in Pull Request #1448 and GitHub Security Advisory GHSA-g5r6-gv6m-f5jv. The change routes file_path through validate_safe_path() to reject traversal sequences and absolute paths that escape the current working directory.

Workarounds

Run the MCP Atlassian server as a low-privilege user in a dedicated container with no access to host secrets
Strip environment variables containing credentials from the server process and load secrets from a scoped secret manager at request time
Disable the confluence_upload_attachment tool in MCP server configuration until the upgrade is deployed
Sandbox the MCP working directory using filesystem namespaces or read-only bind mounts to constrain reachable files

bash

# Upgrade to the patched release
pip install --upgrade "mcp-atlassian>=0.22.0"

# Verify the installed version
python -c "import importlib.metadata; print(importlib.metadata.version('mcp-atlassian'))"

# Optional: run the server with a restricted working directory and non-root user
docker run --rm --user 1000:1000 \
  --read-only --tmpfs /tmp \
  -w /workspace \
  -v /srv/mcp-workspace:/workspace:ro \
  ghcr.io/sooperset/mcp-atlassian:0.22.0