Asana's MCP server bug exposed data across customer organizations

Asana disclosed that a bug in its Model Context Protocol (MCP) server could have exposed one customer's Asana data to other users of the same server.

The company said the flaw was discovered on June 4, 2025, prompting it to take the server offline before restoring it days later.

What happened

Asana, described as a software-as-a-service workplace management platform, said its MCP server had been temporarily taken offline after it found what it called a bug.

Security researchers reported that the hole, discovered June 4, could also have exposed data belonging to other users of Asana's work management platform.

Asana had released the MCP server on May 1.

The server lets AI assistants and other applications reach the Asana Work Graph so customers can pull Asana data into compatible AI applications.

Impact

Asana said the bug described in its disclosure could have potentially exposed certain information from a customer's Asana domain to other Asana MCP users within the projects, teams, tasks, and other Asana objects of the MCP user's permissions.

There was no indication that attackers exploited the bug or that other users actually viewed the information it made accessible.

Response

Asana said the vulnerability was not the result of a hack or malicious activity on its systems.

The company restored the server after fixing the flaw, bringing it back online within days of the disclosure.

Asana did not respond to a reporter's request for comment before publication.

Lessons for security leaders

A security consultant advised teams using MCP connectors to limit the data such projects can access and to audit who has been accessing it.

Security researchers recommended that organizations connecting large language models to internal systems ensure that context servers like MCP enforce strict tenant isolation and least-privilege access.

They also advised teams to maintain granular logs of all requests, especially LLM-generated queries, to support forensic investigations if an incident occurs.