CVE-2026-77252: MCP Atlassian Auth Bypass Vulnerability

CVE-2026-77252 Overview

CVE-2026-77252 is a broken access control vulnerability [CWE-284] in MCP Atlassian, a Model Context Protocol (MCP) server for Atlassian Confluence and Jira. In versions prior to 0.22.0, caller-supplied projects_filter and spaces_filter arguments can replace administrator-configured allowlists. Caller-provided project or space clauses can also suppress configured restrictions. An authenticated caller can search projects or spaces outside the intended boundary whenever the configured Atlassian credentials have access to them. The issue is fixed in version 0.22.0.

Critical Impact
Authenticated MCP clients can bypass administrator-configured allowlists to enumerate and read Jira projects and Confluence spaces outside their intended scope.

Affected Products

MCP Atlassian server versions prior to 0.22.0
Deployments using JIRA_PROJECTS_FILTER administrator allowlists
Deployments using CONFLUENCE_SPACES_FILTER administrator allowlists

Discovery Timeline

2026-09-22 - CVE-2026-77252 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77252

Vulnerability Analysis

MCP Atlassian exposes tool endpoints that let MCP clients search Jira issues and Confluence content. Administrators can restrict scope by setting JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER environment variables. These variables function as allowlists that should bind every search operation.

The vulnerable code paths accept caller-supplied projects_filter and spaces_filter arguments and use them to replace the configured allowlists rather than intersect with them. Callers can also inject project or space clauses directly into search queries that suppress the configured restriction. The advisory identifies SearchMixin.search_issues and SearchMixin.search as the affected entry points.

Root Cause

The root cause is improper enforcement of a server-side authorization boundary [CWE-284]. Filter arguments received from the caller are trusted as authoritative and override the administrator configuration instead of narrowing it. There is no server-side validation that caller filters remain within the configured allowlist scope.

Attack Vector

An authenticated MCP client sends a search request that specifies a projects_filter or spaces_filter value referencing projects or spaces not present in the administrator allowlist. The server issues the underlying Jira or Confluence API call using the configured service credentials. Any project or space visible to those credentials is returned, regardless of the intended tenant boundary.

The vulnerability is described in the GitHub Security Advisory GHSA-rqwg-9346-fjjv. The remediation is tracked in GitHub Pull Request #1448 and merged in commit b041733.

Detection Methods for CVE-2026-77252

Indicators of Compromise

MCP Atlassian request logs containing projects_filter or spaces_filter values that reference identifiers outside the configured JIRA_PROJECTS_FILTER or CONFLUENCE_SPACES_FILTER allowlist.
Jira or Confluence audit events showing search or read activity from the MCP service account against projects or spaces the MCP tenant should not access.
Unexpected JQL or CQL clauses in tool invocations that specify project = or space = values outside the intended scope.

Detection Strategies

Parse MCP Atlassian access logs and flag tool calls where caller-supplied filter arguments are non-empty and differ from the server-configured allowlist.
Correlate Atlassian audit logs from the shared service account with the expected allowlist to identify out-of-scope reads.
Deploy a review of SearchMixin.search_issues and SearchMixin.search invocation patterns for anomalous project or space identifiers.

Monitoring Recommendations

Enable Atlassian Cloud or Data Center audit logging for search and read operations performed by the MCP service account.
Forward MCP Atlassian server logs to a centralized SIEM and alert on filter override attempts.
Track version telemetry across MCP deployments to identify hosts still running versions prior to 0.22.0.

How to Mitigate CVE-2026-77252

Immediate Actions Required

Upgrade all MCP Atlassian server instances to version 0.22.0 or later without delay.
Rotate the Atlassian API tokens used by the MCP server if logs show out-of-scope access.
Audit historical Jira and Confluence access logs for the MCP service account to identify prior boundary violations.

Patch Information

The fix is available in MCP Atlassian release v0.22.0. The patch is applied in commit b041733, which introduces server-side enforcement so that caller-supplied filters can only narrow, not replace, the administrator allowlist. The commit also adds security_regression test markers and hardens related surfaces including attachment handling, transport, SSRF controls, and authorization checks.

python

# Related hardening from the same patch: workspace path confinement
# in src/mcp_atlassian/confluence/attachments.py
try:
    # Confine the upload source to the workspace before it is read: reject
    # traversal/absolute paths that escape CWD (arbitrary file read /
    # exfiltration via a caller-supplied file_path).
    file_path = str(validate_safe_path(file_path))

    # Check if file exists
    if not os.path.exists(file_path):
        return {"success": False, "error": "File not found"}
# Source: https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460

Workarounds

Restrict the Atlassian API token used by the MCP server so that it can only access projects and spaces listed in the intended allowlist, forcing the boundary at the Atlassian side.
Place the MCP Atlassian server behind an authenticating proxy that strips projects_filter and spaces_filter arguments and rejects search queries containing explicit project or space clauses.
Limit MCP client access to trusted callers only until the upgrade to 0.22.0 is complete.

bash

# Verify the installed MCP Atlassian version and upgrade
pip show mcp-atlassian | grep -i version
pip install --upgrade 'mcp-atlassian>=0.22.0'

# Confirm the administrator allowlists are set
echo "JIRA_PROJECTS_FILTER=$JIRA_PROJECTS_FILTER"
echo "CONFLUENCE_SPACES_FILTER=$CONFLUENCE_SPACES_FILTER"