CVE-2026-77251: MCP Atlassian Auth Bypass Vulnerability

CVE-2026-77251 Overview

CVE-2026-77251 is an authorization bypass vulnerability in MCP Atlassian, a Model Context Protocol (MCP) server that exposes Confluence and Jira functionality to AI agents. Versions prior to 0.22.0 fail to enforce JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER across several code paths. Attackers with low-privileged MCP access can retrieve issues, boards, and pages outside their authorized scope when the operator credentials hold broader permissions. The vulnerability is tracked under CWE-1276: Hardware Child Block Incorrectly Connected to Parent System and is fixed in version 0.22.0.

Critical Impact
Low-privileged MCP clients can enumerate Jira issues, agile boards, and Confluence pages outside their configured project or space allowlist, exposing confidential business data.

Affected Products

MCP Atlassian versions prior to 0.22.0
Deployments integrating MCP Atlassian with Jira Cloud or Jira Data Center
Deployments integrating MCP Atlassian with Confluence Cloud or Confluence Data Center

Discovery Timeline

2026-09-22 - CVE-2026-77251 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77251

Vulnerability Analysis

MCP Atlassian exposes Jira and Confluence operations to MCP clients such as large language model agents. Operators configure JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER to restrict which projects and spaces the MCP server will return. The advisory identifies three broken enforcement paths: jira_search, confluence_search, and the Jira board endpoints get_board_issues and get_agile_boards. Each path either performs an incomplete check or omits the filter entirely, letting requests reach the underlying Atlassian APIs with the operator's broader credentials.

Root Cause

The root cause is inconsistent authorization enforcement in the MCP request handlers. jira_search accepts a forbidden project clause because it validates only the presence of project syntax in the Jira Query Language (JQL) input, not the specific project keys. confluence_search uses a case-sensitive space comparison that fails when clients submit space keys in a different case. get_board_issues and get_agile_boards omit the project filter altogether, returning boards linked to any project the service account can reach.

Attack Vector

An authenticated MCP client crafts a search or board request targeting a project or space that is not present in the configured allowlist. Because MCP Atlassian executes the query with operator credentials, the underlying Jira or Confluence API returns results from any scope the credentials can access. The client receives issues, boards, or page content the deployment intended to hide. The attack requires only low privileges on the MCP endpoint and no user interaction.

See the GitHub Security Advisory GHSA-w66g-j6c4-hcfc for the full input and processing flow documented by the maintainer.

Detection Methods for CVE-2026-77251

Indicators of Compromise

MCP Atlassian request logs containing JQL project clauses referencing projects not listed in JIRA_PROJECTS_FILTER.
Confluence Content Query Language (CQL) requests submitting space keys with case variations that bypass the allowlist string comparison.
Unexpected calls to get_board_issues or get_agile_boards returning board identifiers outside the configured project scope.

Detection Strategies

Correlate MCP client identity with the Atlassian project or space keys returned in each response to identify scope violations.
Compare the arguments passed to jira_search and confluence_search against the configured filter environment variables and alert on mismatches.
Inventory the MCP Atlassian version in use across all deployments and flag any instance running below 0.22.0.

Monitoring Recommendations

Enable verbose logging on the MCP Atlassian server and forward request or response metadata to a centralized log store for review.
Monitor Atlassian audit logs for search and board API calls originating from the MCP service account that reference unexpected projects or spaces.
Track upstream releases of sooperset/mcp-atlassian and subscribe to the project's GitHub security advisories.

How to Mitigate CVE-2026-77251

Immediate Actions Required

Upgrade MCP Atlassian to version 0.22.0 or later as published in the GitHub Release v0.22.0.
Rotate the Atlassian API tokens or service credentials used by the MCP server if unauthorized access is suspected.
Audit Jira and Confluence access logs for the MCP service account since deployment to identify prior scope violations.

Patch Information

The fix is contained in commit b041733 and merged via Pull Request #1448. The patch adds security regression tests and hardens attachment, transport, SSRF, authorization, and filter code paths. The commit also confines attachment uploads to the workspace using validate_safe_path to reject traversal or absolute paths that escape the current working directory:

python

            # Confine the upload source to the workspace before it is read: reject
            # traversal/absolute paths that escape CWD (arbitrary file read /
            # exfiltration via a caller-supplied file_path).
            file_path = str(validate_safe_path(file_path))

            # Check if file exists
            if not os.path.exists(file_path):

Source: GitHub Commit b041733

Workarounds

Restrict the Atlassian service account bound to MCP Atlassian to only the projects and spaces intended for MCP consumption, so filter bypasses cannot reach broader data.
Place the MCP Atlassian server behind an authenticating proxy that inspects and rejects requests referencing disallowed project or space keys.
Disable the get_board_issues and get_agile_boards tools in the MCP configuration until the upgrade to 0.22.0 is completed.

bash

# Upgrade MCP Atlassian to the fixed release
pip install --upgrade 'mcp-atlassian>=0.22.0'

# Verify installed version
pip show mcp-atlassian | grep -i version