CVE-2026-77243: MCP Atlassian Auth Bypass Vulnerability

CVE-2026-77243 Overview

CVE-2026-77243 is a missing authorization vulnerability [CWE-862] in MCP Atlassian, a Model Context Protocol (MCP) server for Atlassian Confluence and Jira. Versions prior to 0.22.0 apply the ENABLED_TOOLS and TOOLSETS allow-lists only when tools are enumerated through tools/list. The server does not re-check these controls when a tools/call request is dispatched. A client that already knows a hidden tool name can invoke excluded read, write, or delete tools despite operator-configured least-privilege restrictions. The issue is fixed in version 0.22.0.

Critical Impact
Authenticated clients can bypass administrative tool allow-lists to invoke hidden Confluence and Jira operations, leading to unauthorized data access, modification, or deletion.

Affected Products

MCP Atlassian (sooperset/mcp-atlassian) versions prior to 0.22.0
Deployments exposing Confluence integration through MCP
Deployments exposing Jira integration through MCP

Discovery Timeline

2026-09-22 - CVE-2026-77243 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77243

Vulnerability Analysis

MCP Atlassian exposes Confluence and Jira operations as callable MCP tools. Operators restrict which tools are usable through the ENABLED_TOOLS and TOOLSETS configuration variables. The server enforces those restrictions when returning the tool catalog in response to tools/list. However, the tools/call dispatch path and the internal _call_tool_mcp handler do not re-validate whether the requested tool name falls within the allow-list.

Any authenticated MCP client that discovers or guesses an excluded tool name can invoke it directly. This defeats the operator's least-privilege boundary, enabling reads of restricted content, writes to protected spaces, or destructive delete operations.

Root Cause

The root cause is a missing authorization check on the tool invocation path. Enforcement occurs only during tool enumeration, so the allow-list functions as an interface-hiding control rather than a security boundary. The advisory traces the vulnerable flow through ENABLED_TOOLS, TOOLSETS, tools/list, tools/call, and _call_tool_mcp, confirming that _call_tool_mcp dispatches without consulting the configured allow-list.

Attack Vector

The vector is network-based and requires low privileges (an authenticated MCP session). An attacker crafts a JSON-RPC tools/call request naming any known tool identifier, such as a delete or write operation that was intended to be disabled. The server executes the tool against the connected Atlassian instance using the configured credentials.

python

# Example of the missing check pattern (illustrative, based on advisory description)
# Vulnerable dispatch path in _call_tool_mcp:
#   1. Client sends tools/call with name="confluence_delete_page"
#   2. Server locates the tool implementation
#   3. Server invokes the tool WITHOUT re-checking ENABLED_TOOLS / TOOLSETS
#
# Fixed behavior in v0.22.0 re-validates the tool name against the
# configured allow-list before dispatch.

Source: GitHub Security Advisory GHSA-3r68-hf9h-887v

Detection Methods for CVE-2026-77243

Indicators of Compromise

MCP server logs showing tools/call invocations for tool names not returned by prior tools/list responses in the same session.
Atlassian audit logs recording write or delete operations from the MCP service account that fall outside the intended toolset scope.
Unexpected Confluence page deletions, attachment uploads, or Jira issue transitions originating from the MCP integration identity.

Detection Strategies

Correlate MCP tools/list responses with subsequent tools/call names per session and alert on any call whose target is not in the advertised catalog.
Baseline the set of tool names invoked by each MCP client and flag first-seen tool identifiers, particularly those matching write or delete verbs.
Compare the running MCP Atlassian version against 0.22.0 across container images and Python environments.

Monitoring Recommendations

Forward MCP server request logs and Atlassian audit events to a central analytics platform for cross-source correlation.
Monitor the MCP integration's Atlassian service account for privilege use that exceeds documented business workflows.
Track deployment manifests and Helm charts for pinned MCP Atlassian versions and alert when unpatched releases are scheduled.

How to Mitigate CVE-2026-77243

Immediate Actions Required

Upgrade MCP Atlassian to version 0.22.0 or later in all deployments.
Rotate any Atlassian API tokens or OAuth credentials that the MCP server has used, in case hidden tools were invoked before the upgrade.
Review Confluence and Jira audit logs for unauthorized read, write, or delete operations performed by the MCP service account.

Patch Information

The fix is delivered in MCP Atlassian v0.22.0 via Pull Request #1448 and commit b041733. The release adds authorization enforcement on the tools/call dispatch path along with additional security hardening for attachments, transport, SSRF, and input filtering. Full details are in GHSA-3r68-hf9h-887v.

Workarounds

Restrict the Atlassian service account used by MCP to the minimum Confluence and Jira permissions required, so hidden tools cannot execute privileged actions.
Place the MCP server behind an authenticating proxy that filters JSON-RPC tools/call payloads and rejects tool names outside an explicit allow-list.
Limit network exposure of the MCP endpoint to trusted client hosts until the upgrade to 0.22.0 is completed.

bash

# Upgrade example for pip-based deployments
pip install --upgrade "mcp-atlassian>=0.22.0"

# Verify the installed version
python -c "import importlib.metadata; print(importlib.metadata.version('mcp-atlassian'))"