Disclosed vulnerability
Asana MCP server bug could expose other organisations' tasks and projects to cross-tenant reads
AIR-2025-0042 AIR record · 2025-06-asana-mcp-cross-tenant-exposure
From the supporting source
There is no indication that attackers exploited the bug or that other users actually viewed the information accessible through the MCP bug.upguard.com
The record
Disclosed
2025-06-16
Occurred
2025-05-01
Vendor
Asana
Product
Asana MCP server
Risk domain
Privacy › Sensitive data exposure
System type
Generative model
Who acted
AI was the target (contested) — a tenant isolation flaw in the MCP implementation
Attack surface
MCP server
Autonomy level
Semi-autonomous
Initial vector
Tenant isolation flaw in mcp implementation
Impact type
Potential data exposure, Data exposure, Cross tenant leakage
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0057 – LLM Data Leakage
- NIST AI RMF
- MEASURE 2.10
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Use data anonymization; Implement log sanitization to scrub PII.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
All customers who used the MCP server between 1 May and 4 June 2025
Capability abused
Defense & remediation
Recorded defense
Intended tenant isolation
Guardrail kinds
Sandbox isolation
Guardrail outcome
Silent
Fix shipped
Server taken offline and fixed 4 June 2025; customers notified 16 June 2025
Taxonomy & references
Curator notes
Included with the in-the-wild records rather than the disclosure records because it is one of the few cases where a production MCP integration at a major SaaS vendor had a live tenant-isolation defect for five weeks. impact_realized is false on Asana's statement that no cross-tenant reads are known to have occurred; the exposure was real but unexercised as far as anyone can show. Also reported as: 'Asana MCP server tenant-isolation flaw exposed customer data across organizations'.
Supporting sources
Cite as
Enkrypt AI. "Asana MCP server bug could expose other organisations' tasks and projects to cross-tenant reads". AIR, AIR-2025-0042. https://agentincident.vercel.app/i/AIR-2025-0042/ (accessed 2026-10-19).