CVE-2026-124503 sooperset mcp-atlassian io.py validate_safe_path path traversal
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124503?
CVE-2026-124503 is a medium-severity vulnerability in sooperset mcp-atlassian, published on 10 Nov 2026.
Official description
A vulnerability was identified in sooperset mcp-atlassian up to 0.24.0. This issue affects the function validate_safe_path of the file src/mcp_atlassian/utils/io.py. The manipulation of the argument path leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 0.24.1 is capable of addressing this issue. Upgrading the affected component is recommended. This CVE was requested by the vendor.
Weakness: CWE-22
Which versions are affected by CVE-2026-124503?
How do I fix CVE-2026-124503?
No fix has been published for CVE-2026-124503 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124503 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-124503 exists.
Sources
Also known as GHSA-8fch-hp3f-8mp8, GHSA-qh7q-jmc7-rc7j.