Twenty days after the patch for MCPwnfluence was released, a working exploit for the vulnerability appeared on a Russian-language cybercrime forum.
mcp-atlassian server, allowing attacker-controlled content to be written to sensitive locations and leading to remote code execution.This case is the latest chapter in Operation: MCP, our research into the security boundaries created when organizations connect AI agents to tools, data, and infrastructure. It centers on mcp-atlassian, one of the most popular MCP servers and the subject of our original MCPwnfluence research.
When we published that research, we had not observed active exploitation. KELA recently brought the criminal forum activity to our attention and collaborated with us as we reviewed the evidence. We thank their research team for the collaboration. Their full analysis examines the weaponization timeline in greater detail.
mcp-atlassian is a popular third-party MCP server that lets AI assistants work with Jira and Confluence. Through it, an agent can search pages, manage issues, upload attachments, download files, and perform other actions.
Our original research uncovered two vulnerabilities:
In affected network-accessible deployments, the MCP server also accepted requests without authentication. Chaining these conditions allowed an attacker to control both the content being downloaded and where it would be written.
That turned an AI integration into a path to remote code execution.
The full technical analysis, affected versions, and remediation instructions are available in our original MCPwnfluence disclosure.
The forum post did more than discuss the vulnerabilities. It described a complete malicious request chain demonstrating how they could be combined from beginning to end.
The flow shared on the forum was straightforward:
The attacker connects to the MCP server over HTTP and obtains a valid MCP session ID.
The attacker supplies a spoofed X-Atlassian-Confluence-Url header pointing to an HTTP server they control. In the demonstrated PoC, the value was:
Instead of retrieving an attachment from a legitimate Confluence server, the MCP server retrieves attacker-controlled content.
The attacker invokes the confluence_download_attachment tool and supplies an unrestricted destination:
The vulnerable server writes the downloaded content to /etc/cron.d/cron_file without checking whether the path is safe.
The key is the combination: the attacker controls both the source of the content and its destination on the filesystem.
Once the malicious cron file is written, the attacker waits for the scheduled job to run and connect back to their listener.
What began as an AI tool call ends as code execution on the host.
MCPwnfluence is not the only example of attackers moving quickly to exploit weaknesses in the MCP ecosystem.
We saw the same pattern with CVE-2026-33032 in nginx-ui, another vulnerability discovered during our MCP research.
nginx-ui had added MCP support to let agents manage nginx configurations. However, its MCP message endpoint was missing authentication. Anyone who could reach it could invoke powerful tools to read configurations, modify them, and reload nginx.
In this case, the MCP integration did not merely expose an AI feature. It exposed control over the web server and everything behind it.
Evidence of active exploitation emerged shortly after the security advisory was published. Recorded Future identified the vulnerability as actively exploited in March 2026, and it was later added to VulnCheck’s Known Exploited Vulnerabilities catalog.
A similar story unfolded with Flowise, a widely used platform for building AI agents and workflows.
Security researcher Kim SooHyun discovered CVE-2025-59528, a CVSS 10.0 vulnerability in Flowise’s CustomMCP component. Flowise accepted MCP server configuration from a user and passed it into JavaScript’s Function() constructor. In simple terms, the platform treated configuration data as code.
That allowed an attacker to run commands on the Flowise host. VulnCheck later detected exploitation attempts through its Canary network, more than six months after a patch had become available.
Attackers do not need to defeat the model when the integration around it provides a simpler path.
Organizations see MCP servers as useful connectors. Attackers see software that often combines several valuable properties in one place:
That makes MCP servers an attractive bridge from agent tooling to host-level compromise.
The underlying bugs are not always new. MCPwnfluence combined missing authentication, server-side request forgery, and an unrestricted file write. nginx-ui missed an authentication check on a powerful endpoint. Flowise evaluated configuration as executable code.
These are familiar security failures. What is new is where they now live and how much access the affected component already has.
As AI becomes embedded in everyday work, third-party AI components are becoming part of the path attackers use to enter enterprise environments.
This is the pattern we have been documenting through Operation: MCP: adoption is moving faster than most organizations’ ability to discover, review, and govern it.
Our research has examined the code organizations install, the services they expose, the identities agents inherit, and the external instructions those agents trust. The exploitation and weaponization of vulnerabilities across mcp-atlassian, nginx-ui, and Flowise show why those boundaries matter.
The same analysis logic that allowed us to discover MCPwnfluence is now integrated into MCP Inspector. It gives organizations a practical way to examine third-party MCP components and identify dangerous behavior before trusting them with access to sensitive systems.
Responsible disclosure gave defenders a meaningful head start.
The maintainer released the patched mcp-atlassian version 0.17.0 on February 24. We published our research on February 26. The CVEs appeared on the NVD on March 10. The criminal PoC appeared on March 16.
Organizations that followed the project or our disclosure had 20 days from the patch release to the appearance of the criminal exploit. Vulnerability management programs that waited for the NVD listing had only six.
But a patch only helps when teams know the affected software is running.
Organizations using mcp-atlassian should upgrade immediately to version 0.17.0 or later. They should also identify every MCP server in their environment, review its network exposure, restrict its filesystem and network permissions, and stop treating locally installed AI integrations as harmless plugins.
To an organization, an MCP server may look like a connector. To an attacker, it may be the shortest path in.
Pluto’s platform starts with discovery: every connector, skill, plugin, and MCP server already running across an organization’s AI stack, sanctioned or not. From there, risk assessment surfaces exactly the kind of gap covered in this piece, and enforcement closes it before an attacker finds it first. MCP servers are one surface in that stack. The same blind spot shows up in browser extensions, coding agents, and the plugins builders install without asking anyone first.
If your team is using MCP servers, self-hosted or otherwise, and wants someone to verify everything’s under control, book time with us and we’ll show you what we’d find in yours.
