CVE-2026-73498: MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, co
Summary
MCP Atlassian (a server that connects AI tools to Atlassian products like Confluence and Jira) had a vulnerability in versions before 0.22.0 where the confluence_upload_attachment function didn't properly validate file paths, allowing an authenticated attacker to read any file the server could access and upload it to Confluence. This could expose sensitive credentials like API tokens if an AI agent is tricked into using this function through untrusted input.
Solution / Mitigation
This issue is fixed in version 0.22.0.
Vulnerability Details
7.7(high)
EPSS: 0.0%
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
network
low
low
none
August 12, 2026
Classification
Affected Vendors
Related Issues
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
CVE-2024-27444: langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-73498
First tracked: August 12, 2026 at 08:07 PM
Classified by LLM (prompt v3) · confidence: 92%