What happened
Security firm Pluto Security's March 2026 disclosure of two chained mcp-atlassian bugs (header-based SSRF bypassing auth, plus a path-traversal arbitrary file write) was reported on Sept 16, 2026 to have moved from responsible disclosure to a weaponized public PoC appearing on a cybercrime forum within 20 days, with active exploitation subsequently confirmed by Recorded Future and added to VulnCheck's KEV catalog.
Why it matters
This is a textbook AI-agent supply-chain compromise: an exposed, unauthenticated MCP tool server became a bridge from an external HTTP request straight into the filesystem and then into agent-connected Jira/Confluence workflows, giving attackers a path to RCE on any organization still running vulnerable, internet-reachable instances.
Attack vector
An attacker sends a crafted request with custom headers (e.g. X-Atlassian-Confluence-Url) that bypasses missing-Authorization checks, triggering an SSRF that lets the server fetch attacker-controlled content; a second arbitrary-path-write bug lets that content be written to any location on the host filesystem, including paths that achieve remote code execution.
Affected systems
mcp-atlassian (PyPI) < 0.17.0
Mitigation
Upgrade to mcp-atlassian >= 0.17.0; remove unnecessary network exposure of MCP servers; enforce authentication; restrict filesystem/network permissions for the MCP host process.