Why it matters
MCP Atlassian is a widely deployed MCP server bridging LLM agents to Jira/Confluence. In shared/remote deployments this turns an LLM-agent tool call into an arbitrary-file-read primitive against the server's own filesystem, exposing credentials that a whole tenant's agents rely on.
Attack vector
confluence_upload_attachment(s) and jira_update_issue attachment tools pass a client-controlled file_path directly to upload_attachment without confining it to an approved server workspace. In remote HTTP/SSE/multi-user deployments, an absolute or traversing path lets a client with write-tool access upload arbitrary server files (including environment-held Atlassian credentials or another tenant's data) to Atlassian, disclosing them. A related SSRF issue (CVE-2026-73497, CVSS 6.5) lets attacker-controlled X-Atlassian-*-Url headers be revalidated at connect time rather than the checked time, enabling DNS-rebind SSRF against internal services.
Affected systems
sooperset/mcp-atlassian < 0.22.0
Mitigation
Upgrade to mcp-atlassian 0.22.0. Local single-user stdio deployments do not cross this trust boundary; remote/multi-user deployments should upgrade immediately.