CVE-2026-77244: MCP Atlassian Auth Bypass Vulnerability

CVE-2026-77244 Overview

CVE-2026-77244 is an authentication bypass vulnerability in MCP Atlassian, a Model Context Protocol (MCP) server that exposes Atlassian Confluence and Jira tools to AI clients. Versions prior to 0.22.0 accept HTTP transport requests without verifying user identity. When no identity is present, downstream fetcher construction falls back to the operator's globally configured Jira or Confluence credentials. Any network client that can reach the MCP endpoint can invoke Atlassian tools as the operator, performing both read and write actions permitted to that account. The issue maps to [CWE-287: Improper Authentication] and is fixed in version 0.22.0.

Critical Impact
Unauthenticated network attackers can execute Atlassian read and write operations using the operator's Jira and Confluence credentials, enabling data theft, tampering, and lateral movement inside connected Atlassian tenants.

Affected Products

MCP Atlassian server versions prior to 0.22.0
Deployments exposing the MCP HTTP (streamable-http) transport
Instances configured with operator-level Jira or Confluence credentials

Discovery Timeline

2026-09-22 - CVE-2026-77244 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77244

Vulnerability Analysis

MCP Atlassian exposes Confluence and Jira operations to MCP clients over an HTTP transport. The advisory identifies the vulnerable flow through UserTokenMiddleware, AtlassianOpaqueTokenVerifier, _get_fetcher, and the streamable-http transport. The HTTP transport processes tool invocations without a verified user identity attached to the request context.

When the request context lacks a validated user token, _get_fetcher constructs the Atlassian client using the server operator's globally configured credentials. Tool calls then run with the privileges of that operator account. Because the check happens at fetcher construction rather than at request admission, any tool exposed by the server becomes reachable by any network client that can hit the endpoint.

Impact is scoped to whatever the operator credentials can do inside Confluence and Jira, which typically includes reading pages, projects, and issues, plus creating, updating, or deleting content. Cross-tenant impact is possible when a single MCP deployment fronts multiple Atlassian workspaces.

Root Cause

The root cause is missing authentication enforcement in the HTTP transport combined with an unsafe credential fallback. UserTokenMiddleware and AtlassianOpaqueTokenVerifier do not reject requests that arrive without a verified caller identity. Instead of failing closed, _get_fetcher substitutes the operator's globally configured Jira or Confluence credentials, elevating anonymous callers to operator privilege.

Attack Vector

Exploitation requires only network reachability to the MCP endpoint. An attacker sends a standard MCP tool invocation over the streamable-http transport without supplying a token. The server processes the call, builds a fetcher using operator credentials, and executes the requested Atlassian API action. No user interaction and no prior privilege are required.

python

# Patch excerpt: src/mcp_atlassian/confluence/attachments.py
# Replaces unchecked path handling with workspace-confined validation
# to block traversal and absolute-path escapes during attachment upload.

            # Confine the upload source to the workspace before it is read: reject
            # traversal/absolute paths that escape CWD (arbitrary file read /
            # exfiltration via a caller-supplied file_path).
            file_path = str(validate_safe_path(file_path))

            # Check if file exists
            if not os.path.exists(file_path):
# Source: https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460

Detection Methods for CVE-2026-77244

Indicators of Compromise

MCP Atlassian HTTP transport requests that reach tool endpoints without an Authorization header or opaque token
Jira or Confluence audit log entries showing operator-account activity originating from the MCP service host at times inconsistent with legitimate MCP client sessions
Unexpected create, update, or delete events in Confluence pages or Jira issues attributed to the operator identity
Outbound Atlassian API calls from the MCP server correlated with inbound requests from unknown source IPs

Detection Strategies

Inspect MCP server access logs for streamable-http tool invocations that succeed while carrying no verified user identity
Correlate MCP request logs with Atlassian audit logs to identify operator actions that lack a corresponding authenticated MCP session
Alert on any exposure of the MCP Atlassian HTTP endpoint to networks outside the intended client set

Monitoring Recommendations

Enable and centrally ship Atlassian Cloud or Data Center audit logs alongside MCP server logs
Baseline normal operator-account API volume and alert on deviations, especially write operations
Monitor egress from the MCP host for anomalous Confluence or Jira API traffic patterns

How to Mitigate CVE-2026-77244

Immediate Actions Required

Upgrade MCP Atlassian to version 0.22.0 or later, which contains the authentication fix
Restrict network access to the MCP endpoint using firewall rules, service mesh policy, or a reverse proxy that enforces authentication
Rotate the operator Jira and Confluence API tokens configured on the MCP server after upgrading
Review Confluence and Jira audit logs for unauthorized activity attributed to the operator account since the HTTP transport was first exposed

Patch Information

The fix is delivered in MCP Atlassian 0.22.0. See the GitHub Security Advisory GHSA-wrhw-j3f9-8vc6, the GitHub Release v0.22.0, the GitHub Pull Request #1448, and the GitHub Commit Update for the full change set covering transport authentication, SSRF, authorization, and attachment hardening.

Workarounds

Disable the HTTP (streamable-http) transport and use the stdio transport with a trusted local client until upgrade is possible
Place the MCP endpoint behind an authenticating reverse proxy that requires mutual TLS or bearer tokens for every request
Bind the MCP service to localhost or a private management network and block all external ingress
Provision the MCP operator credentials with the minimum Jira and Confluence permissions required for intended tool usage

bash

# Configuration example: verify installed version and pin to the fixed release
pip show mcp-atlassian | grep -i version
pip install --upgrade 'mcp-atlassian>=0.22.0'

# Restrict HTTP transport exposure to loopback only
export MCP_ATLASSIAN_HTTP_HOST=127.0.0.1
export MCP_ATLASSIAN_HTTP_PORT=8000