CVE-2026-73496 & CVE-2026-73497 - MCP Atlassian path traversal file upload and DNS rebinding SSRF expose server secrets and internal services - Upwind

Security Feed

See the latest insights and analysis from our MDR team.

CVE-2026-73496, CVE-2026-73497

By Roy Kalfon |

15 September 2026

CVE-2026-73496 & CVE-2026-73497 – MCP Atlassian path traversal file upload and DNS rebinding SSRF expose server secrets and internal services

In mcp-atlassian, client-controlled attachment file_path (Confluence tools and Jira attachments) is uploaded without workspace confinement, letting write-tool clients exfiltrate MCP server files/Atlassian creds in remote HTTP/SSE/multi-user deploys (`

Learn More

Full Feed

Security Feed

CVE-2026-73496 & CVE-2026-73497 – MCP Atlassian path traversal file upload and DNS rebinding SSRF expose server secrets and internal services

Product

General

Social

Resources