CVE-2026-73498: mcp-atlassian Uploads Any File the Server Can Read Into Confluence (CVSS 7.7)

In mcp-atlassian before 0.22.0, the confluence_upload_attachment tool passes a client-supplied file_path straight to open(file_path, 'rb') without calling the project's own validate_safe_path helper, so an authenticated MCP client can read any file the server process can reach and have it exfiltrated to Confluence as an attachment. NVD published it on 12 August 2026 at CVSS 7.7 as GHSA-g5r6-gv6m-f5jv, and it is fixed in 0.22.0. Two things make it more serious than an ordinary path-traversal read. First, exfiltration is built in rather than left as an exercise: the tool's whole purpose is to put a file somewhere it can be fetched, so a successful read is already a delivered file. Second, the caller need not be a human attacker - an agent talked into calling the tool through untrusted content reaches the same outcome, and the files most worth taking include the server's own environment, where CONFLUENCE_API_TOKEN lives. This is the second serious flaw in this server in 2026, after the unauthenticated file-write chain in CVE-2026-27825, and the package carries several million downloads.

You are affected if you run mcp-atlassian <0.22.0. Versions 0.22.0 and later include the fix.

Upgrade to 0.22.0 or later, and then rotate what the vulnerable version could have handed over rather than stopping at the version bump: the CONFLUENCE_API_TOKEN and any other credential present in the server process's environment should be treated as disclosed if this server was reachable by anything you do not control. Check Confluence for the evidence while you are there, because this vulnerability leaves an unusually legible trail - attachments are the exfiltration channel, so unexpected attachments on pages the server can write to are the artefact to search for. For the longer term, note that both 2026 flaws in this server come from the same place, a client-supplied path used without confinement, so run it as a low-privilege user in a container with no access to credential files or SSH material, and do not expose its HTTP transport beyond the hosts that need it.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run mcp-atlassian and which version, then enforce a policy on it.