CVE-2026-77254: MCP Atlassian Auth Bypass Vulnerability

CVE-2026-77254 Overview

CVE-2026-77254 is a missing authentication vulnerability [CWE-306] in MCP Atlassian, a Model Context Protocol (MCP) server for Atlassian Confluence and Jira. Versions prior to 0.22.0 allow requests to the HTTP MCP endpoint without a per-user identity to reach tool handlers. These handlers then execute against globally configured Jira or Confluence credentials. A network-based caller can perform operations with the operator account's permissions when the deployment lacks an independent authentication boundary. The issue is fixed in version 0.22.0.

Critical Impact

Unauthenticated network attackers can invoke Jira and Confluence tool handlers using the operator's globally configured credentials, enabling data read, modification, and privileged operations.

Affected Products

• MCP Atlassian versions prior to 0.22.0
• Deployments exposing the HTTP MCP endpoint (streamable-http transport)
• Configurations relying on global Jira or Confluence credentials without an external authentication boundary

Discovery Timeline

• 2026-09-22 - CVE-2026-77254 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77254

Vulnerability Analysis

The vulnerability resides in the HTTP MCP transport of MCP Atlassian. Requests reach tool handlers without carrying a per-user identity token. The UserTokenMiddleware fails to enforce identity presence before dispatching. Downstream, the _get_fetcher helper resolves to globally configured Jira or Confluence credentials when no per-user context is available.

Because the tool handlers proceed with the operator's globally scoped API credentials, any network-reachable caller can invoke Confluence and Jira operations under those permissions. Attackers can read, modify, or delete content that the operator account can access. Impact scales with the privilege level of the configured service account.

Root Cause

The root cause is missing authentication for a critical function [CWE-306]. The streamable-http entry point accepts requests without verifying caller identity. The middleware permits anonymous access to fall through to handlers that assume valid authorization. Fallback to global credentials converts an authentication gap into full authorization for external callers.

Attack Vector

Exploitation requires only network access to the MCP HTTP endpoint. No authentication, user interaction, or elevated privileges are needed. An attacker sends crafted MCP tool invocation requests over HTTP. The server processes them using operator credentials and returns Confluence or Jira data or executes state-changing actions.

# Patch excerpt: src/mcp_atlassian/confluence/attachments.py
# Confine the upload source to the workspace before it is read: reject
# traversal/absolute paths that escape CWD (arbitrary file read /
# exfiltration via a caller-supplied file_path).
file_path = str(validate_safe_path(file_path))

# Check if file exists
if not os.path.exists(file_path):

Source: GitHub Commit b041733

Detection Methods for CVE-2026-77254

Indicators of Compromise

• HTTP requests to the MCP endpoint that lack per-user identity headers or bearer tokens
• Jira or Confluence audit log entries showing unexpected API activity from the operator service account
• MCP server logs where _get_fetcher resolves to global credentials for external client requests
• Bulk read or export operations against Confluence spaces or Jira projects outside normal usage patterns

Detection Strategies

• Correlate MCP server request logs with Atlassian audit trails to identify actions attributed to the operator account but originating from unrecognized network sources
• Alert on any invocation of MCP tool handlers via streamable-http where UserTokenMiddleware did not attach a user context
• Baseline normal MCP client source addresses and flag connections from outside expected ranges

Monitoring Recommendations

• Enable verbose logging on the MCP HTTP endpoint capturing source IP, request path, and authentication state
• Forward Confluence and Jira audit events to a central SIEM for correlation with MCP server telemetry
• Monitor rate and volume of API calls made under the globally configured service account

How to Mitigate CVE-2026-77254

Immediate Actions Required

• Upgrade MCP Atlassian to version 0.22.0 or later without delay
• Restrict network access to the MCP HTTP endpoint using firewall rules, private networks, or a reverse proxy that enforces authentication
• Rotate any Jira and Confluence API tokens or credentials that were configured globally on affected deployments
• Review Confluence and Jira audit logs for unauthorized activity attributed to the operator service account

Patch Information

The fix is available in MCP Atlassian 0.22.0. Details are published in the GitHub Security Advisory GHSA-vc8m-84rp-53hx, the GitHub Release v0.22.0, and Pull Request #1448.

Workarounds

• Place the MCP HTTP endpoint behind an authenticating reverse proxy that requires per-user credentials before forwarding requests
• Deploy the server on an isolated network segment reachable only by trusted MCP clients
• Restrict the globally configured Jira and Confluence account to the minimum permissions required until the upgrade is complete

# Example: restrict MCP endpoint exposure with a host-level firewall rule
# Allow only trusted client subnet, drop all other inbound traffic to the MCP port
iptables -A INPUT -p tcp --dport 8000 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP