Asana took the server offline and informed customers using the MCP server on June 16 about the bug. "As soon as the vulnerability was discovered, our teams immediately took the MCP server down and ...

However, the tool was implemented with a bug that exposed data from Asana instances to other MCP users. Not all data was exposed, though, as it was limited to each user’s access scope.