{
 "id": "AIR-2026-0075",
 "slug": "cve-2026-73498-path-traversal-flaw-in-mcp-atlassian-server-a",
 "title": "CVE-2026-73498: Path traversal flaw in MCP Atlassian server allows arbitrary file read",
 "summary": "The MCP Atlassian server prior to version 0.22.0 lacks safe path validation in attachment uploads, enabling authenticated clients or induced AI agents to read and exfiltrate arbitrary files. This can lead to the exposure of sensitive server environment variables.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln",
  "agent_hijack"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling",
  "enterprise_deployment"
 ],
 "products": [
  "MCP Atlassian"
 ],
 "incident_date": "2026-08-12",
 "incident_date_precision": "day",
 "first_reported": "2026-08-12",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73498",
   "publisher": "NVD",
   "title": "CVE-2026-73498: MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).",
   "published_at": "2026-08-12"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-73498",
  "mcp",
  "path-traversal",
  "atlassian"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}