A critical path traversal vulnerability in Sooperset mcp-atlassian allows unauthenticated attackers to access sensitive files on the host server, necessitating an immediate update to version 0.22.0.

The confluence_upload_attachment function fails to properly validate the file_path parameter, enabling path traversal beyond the intended workspace. This vulnerability can be triggered by an unauthenticated attacker to read arbitrary files accessible to the server process.

The ability for an unauthenticated attacker to read arbitrary files presents a severe risk of sensitive data exposure, including configuration files, credentials, or proprietary information stored on the server. With a CVSS score of 8.6, this vulnerability carries a high risk of compromise to the confidentiality of the entire Atlassian integration environment.

Immediate Action: Update the mcp-atlassian package to version 0.22.0 or later immediately to apply the path validation fix.

Proactive Monitoring: Review application and system access logs for unusual file access patterns or attempts to access directory traversal sequences such as dot-dot-slash.

Compensating Controls: Implement strict network segmentation and ensure the service account running the MCP server operates with the least privilege necessary to limit the impact of potential file access.

Public Exploit Available: No

Given the high CVSS score and the potential for unauthorized data access, organizations using mcp-atlassian should prioritize this update. Ensure that all deployments are patched to version 0.22.0 to prevent exploitation of this path traversal mechanism and maintain the security of your Atlassian integration environment.