A manipulated identifier and metadata link could change download paths and credential scope. Entry and authority. An attacker controls attachment_id or upstream attachment metadata consumed by the Confluence tool. Observed mechanism and consequence. Path normalization and absolute download links could reroute requests to attacker-controlled origins;…
Inspect the ClaimsCase · DiggingBeagle record
MCP Atlassian attachment identifiers enabled path injection and off-origin downloads
A manipulated identifier and metadata link could change download paths and credential scope.
Public disclosure: Nov 8, 2026
Scope
An attacker controls attachment_id or upstream attachment metadata consumed by the Confluence tool. Path normalization and absolute download links could reroute requests to attacker-controlled origins; version 0.24.1 validates ID and origin.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-GHSA-CF68-PXW7-C8FR; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-ATL-GHSA-CF68-PXW7-C8FR-01 · CLM-DB233-ATL-GHSA-CF68-PXW7-C8FR-02 · mcp-atlassian advisory GHSA-cf68-pxw7-c8fr
At a glance
Off-origin credential forwarding was reproduced with mock responses, not confirmed against production Confluence.
Limits and uncertaintyFull account
A manipulated identifier and metadata link could change download paths and credential scope.
Entry and authority. An attacker controls attachment_id or upstream attachment metadata consumed by the Confluence tool.
Observed mechanism and consequence. Path normalization and absolute download links could reroute requests to attacker-controlled origins; version 0.24.1 validates ID and origin.
Limits and status. Off-origin credential forwarding was reproduced with mock responses, not confirmed against production Confluence.
The download path combined an attachment identifier and a download URL derived from returned Confluence metadata. The identifier could alter the API path, while an untrusted absolute download location could move a later authenticated fetch outside the approved Atlassian origin. The reported off-origin credential-forwarding demonstration used controlled response behavior; real Confluence issuance of an equivalent link was not independently shown.
Mechanism and trust boundary
- 01
Precondition and trust context
An attacker controls attachment_id or upstream attachment metadata consumed by the Confluence tool.
- 02
Crossed boundary
Path normalization and absolute download links could reroute requests to attacker-controlled origins; version 0.24.1 validates ID and origin.
- 03
Observed limit
Off-origin credential forwarding was reproduced with mock responses, not confirmed against production Confluence.
Timeline
- Nov 8, 2026Event type unspecified
Initial documented finding
MCP Atlassian attachment identifiers enabled path injection and off-origin downloads
- Nov 8, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-ATL-GHSA-CF68-PXW7-C8FR-01The GHSA-cf68-pxw7-c8fr advisory documents that path normalization and absolute download links could reroute requests to attacker-controlled origins; version 0.24.1 validates ID and origin.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-cf68-pxw7-c8frprimary disclosure
Advisory: Summary and Details
CLM-DB233-ATL-GHSA-CF68-PXW7-C8FR-02The disclosed precondition is: An attacker controls attachment_id or upstream attachment metadata consumed by the Confluence tool.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-cf68-pxw7-c8frprimary disclosure
Advisory: Affected configurations and reproduction
Controls and mitigations
- Validate attachment IDs as identifiers, pin download origin and filter Authorization headers on redirects; apply the 0.24.1 fix.
- Treat URL fields returned by an external service as data requiring destination authorization, even when the first API request was authenticated.
Unknowns and contradictions
- Off-origin credential forwarding was reproduced with mock responses, not confirmed against production Confluence.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235