CVE-2026-124503: mcp-atlassian: path traversal in validate_safe_path read

MEDIUM

Published November 10, 2026

CISO Take

mcp-atlassian, an MCP server that lets AI agents read and write Jira and Confluence, has a path traversal flaw in its validate_safe_path function. A low-privileged remote user can use it to reach files outside the intended directory, with limited confidentiality impact (CVSS 4.3, medium). The package has only 2 tracked downstream dependents, but 39 other CVEs have been filed against it, which points to a weak security track record. The vendor advisory (GHSA-qh7q-jmc7-rc7j) is tagged as exploit material and the description says an exploit is public, although our feed shows no Nuclei template, no KEV listing and no EPSS score yet. Upgrade to mcp-atlassian 0.24.1 and check that agent hosts do not keep credentials or secrets in paths the MCP process can read.

Sources:NVDGitHub AdvisoryATLASVulDB

What is the risk?

Low-to-medium. Exploitation is network-based, low complexity, needs no user interaction and needs low privileges. Impact is limited to partial confidentiality loss, with no integrity or availability effect. The vendor advisory and a public exploit lower the barrier to exploitation. It is not in CISA KEV, there is no EPSS data and no scanner template. Real exposure depends on whether the MCP server runs in HTTP/SSE mode reachable by untrusted users and which files the process user can read. Local stdio deployments are much less exposed. The agent-facing role raises the stakes slightly because an LLM can be steered into supplying the malicious path.

How does the attack unfold?

Initial Access

The attacker reaches a network-exposed mcp-atlassian server with a low-privileged account, or influences the agent's tool arguments through injected content.

AML.T0049

Exploitation

A crafted path argument with traversal sequences bypasses validate_safe_path and escapes the allowed directory.

AML.T0053

Collection

The server reads files outside the intended directory, such as configuration files or .env files holding tokens.

AML.T0037

Impact

Exposed credentials or data are returned to the attacker, enabling follow-on access to Atlassian and other connected systems.

AML.T0055

Initial Access

The attacker reaches a network-exposed mcp-atlassian server with a low-privileged account, or influences the agent's tool arguments through injected content.

AML.T0049

Exploitation

A crafted path argument with traversal sequences bypasses validate_safe_path and escapes the allowed directory.

AML.T0053

Collection

The server reads files outside the intended directory, such as configuration files or .env files holding tokens.

AML.T0037

Impact

Exposed credentials or data are returned to the attacker, enabling follow-on access to Atlassian and other connected systems.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MCP Atlassian	pip	—	No patch
2 dependents83% patched~4d to patchFull package profile →

Do you use MCP Atlassian? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 46% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

INone

ANone

What should I do?

1 step

1) Upgrade mcp-atlassian to 0.24.1 or later (pip install -U mcp-atlassian), which includes the fix from PR #1448. 2) Run the MCP server under a dedicated least-privilege user, in a container with a read-only root filesystem and only the required volumes mounted. 3) Do not expose the HTTP/SSE transport to untrusted networks; require authentication and network allow-lists. 4) Keep secrets and credentials out of paths readable by the server process, and rotate Atlassian API tokens if exposure is suspected. 5) Detection: log and alert on tool calls with path arguments containing '..', encoded traversal sequences or absolute paths, and review MCP server logs for unexpected file access. 6) Inventory agent hosts and CI images that pin mcp-atlassian.

How is it classified?

Data LeakageData ExtractionAgentPluginAML.T0037- Data from Local System AML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-124503?

Is CVE-2026-124503 actively exploited?

No confirmed active exploitation of CVE-2026-124503 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-124503?

1) Upgrade mcp-atlassian to 0.24.1 or later (pip install -U mcp-atlassian), which includes the fix from PR #1448. 2) Run the MCP server under a dedicated least-privilege user, in a container with a read-only root filesystem and only the required volumes mounted. 3) Do not expose the HTTP/SSE transport to untrusted networks; require authentication and network allow-lists. 4) Keep secrets and credentials out of paths readable by the server process, and rotate Atlassian API tokens if exposure is suspected. 5) Detection: log and alert on tool calls with path arguments containing '..', encoded traversal sequences or absolute paths, and review MCP server logs for unexpected file access. 6) Inventory agent hosts and CI images that pin mcp-atlassian.

What systems are affected by CVE-2026-124503?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, MCP servers, Tool-augmented LLM assistants, Enterprise knowledge-base integrations.

What is the CVSS score for CVE-2026-124503?

CVE-2026-124503 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.54%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksMCP serversTool-augmented LLM assistantsEnterprise knowledge-base integrations

MITRE ATLAS Techniques

AML.T0037Data from Local System

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

Compliance Controls Affected

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

A vulnerability was identified in sooperset mcp-atlassian up to 0.24.0. This issue affects the function validate_safe_path of the file src/mcp_atlassian/utils/io.py. The manipulation of the argument path leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 0.24.1 is capable of addressing this issue. Upgrading the affected component is recommended. This CVE was requested by the vendor.

Exploitation Scenario

An attacker with a low-privileged account on a shared mcp-atlassian instance, or one who can influence an agent's tool arguments through a poisoned Jira ticket or Confluence page, supplies a crafted path with traversal sequences to a file-handling tool. validate_safe_path fails to normalize it correctly, so the server reads a file outside the intended directory, such as an .env file with Atlassian or other service tokens. The attacker retrieves the contents through the tool response and uses the stolen credentials to reach further internal resources.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryPrimary CWE-22Improper Limitation of a Pathname to a Restricted Directory

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.