AIA-025 Atlassian MCP: malicious support ticket could make an internal user's AI action leak data, per Cato Networks (PoC)

ID: AIA-025
Category: AI AI agent incident
Disclosed: 2025-06
Systems: Atlassian MCP / Jira Service Management
Harm type: Prompt injection / data leak
Status: reported
Reported by the source as a proof of concept; no vendor fix statement recorded.

Summary

Cato CTRL described a proof of concept in which an external user "submits a malicious support ticket" and an internal user then "invokes an MCP-connected AI action," which breaks the boundary between external and internal users.

Controls

Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.

NIST AI RMF

MEASURE 2.7 Security and resilience are evaluated and documented
MAP 4.1 Risks from third-party components are mapped

NIST SP 800-53

AC-4 Information Flow Enforcement
AC-6 Least Privilege
SI-10 Information Input Validation

Human-approval (JCR) checkpoint

yes: writing internal data back into the attacker's ticket (externally visible)

Sources

catonetworks.com primary link checked 2026-10-31, HTTP 200
Post dated June 19, 2025
https://www.catonetworks.com/blog/cato-ctrl-poc-attack-targeting-atlassians-mcp/

Corrections

2026-10-29 Review round 2: JCR checkpoint changed from partial to yes. An ungated read path does not make it partial under the method; disclosure needed an externally visible ticket write that approval could have prevented.

To report an error in this entry, see corrections.