Asana takes its MCP server offline after a cross-organization data exposure bug
A bug in Asana’s MCP server could have exposed information from one customer’s workspace to MCP users at other customers. Asana disabled the server for nearly two weeks.
- Occurred
- Disclosed
- Published
- Organization
- Asana
- System
- Asana MCP server
- Impact
- Data from one organization potentially visible to MCP users in other organizations; server offline from June 5 to June 17
Timeline
- 2025-05-01. Asana launches its MCP server, according to The Register.
- 2025-06-04. The bug is found.
- 2025-06-05. Asana disables the MCP server.
- 2025-06-17. The server is back online.
Trigger or entry point
Not stated by the source.
Failure mechanism
Asana’s status page says only that it “identified a bug” in the MCP server. The Register quotes Asana’s notice to customers: the bug could have exposed certain information from a customer’s Asana domain to other Asana MCP users. Neither source describes the coding error.
Impact
The Register reports no indication that the bug was exploited or that users actually saw other organizations’ data. Asana did not say how many customers were affected. According to the status page, the MCP server is an opt-in feature, and the maintenance covered Asana’s API in the United States, the European Union, Japan and Australia.
Response
Asana took the server offline, fixed the bug and contacted affected customers directly. An Asana spokesperson told The Register that a full incident report would follow. Asana’s status page ran the event under the heading “MCP Maintenance” and gave no detail of the cause.
Mitigations
All MCP connections were reset, so customers had to reconnect manually. The status page marks the server as operational again from 2025-06-17, 16:51 UTC.
Sources
- MCP Maintenance (Asana status page)primary · 2025-06-05
- Asana MCP server back online after plugging a data-leak holesecondary · 2025-06-18
Corrections
No corrections have been made to this entry.
Report a correction