CVE-2026-77272: MCP Atlassian OAuth XSS Vulnerability

CVE-2026-77272 Overview

CVE-2026-77272 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in MCP Atlassian, a Model Context Protocol (MCP) server that bridges AI assistants to Atlassian Confluence and Jira. Versions prior to 0.22.0 pass the OAuth error query parameter directly to CallbackHandler._send_response in oauth_setup.py. The handler interpolates the value into an HTML response without escaping. A crafted authorization callback URL can inject markup or script that executes in the browser of any user completing the OAuth flow. The issue is fixed in version 0.22.0.

Critical Impact
An attacker can craft a malicious OAuth callback link that executes arbitrary JavaScript in the victim's browser session, enabling credential theft, session hijacking, or manipulation of the MCP OAuth setup flow.

Affected Products

MCP Atlassian versions prior to 0.22.0
Deployments exposing the OAuth setup callback endpoint from oauth_setup.py
Integrations using MCP Atlassian for Confluence or Jira OAuth authorization

Discovery Timeline

2026-09-22 - CVE-2026-77272 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77272

Vulnerability Analysis

The vulnerability resides in the OAuth callback handling logic of MCP Atlassian. When an OAuth authorization server redirects a user back to the MCP callback endpoint, standard OAuth 2.0 error responses include an error query parameter describing why authorization failed. The CallbackHandler._send_response method in oauth_setup.py reads this parameter and inserts it into an HTML page returned to the user's browser.

Because the value is interpolated without HTML entity escaping, an attacker controls a portion of the rendered document. Delivering a crafted callback URL to a target user causes the browser to render attacker-supplied HTML or execute injected JavaScript in the context of the MCP callback origin.

Root Cause

The root cause is missing output encoding on untrusted user input before HTML rendering. The error query parameter is treated as trusted text and concatenated into the response body. No escaping, allow-listing, or templating engine with autoescape sits between the parameter value and the HTML sink, producing a classic reflected XSS sink as defined by [CWE-79].

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL pointing at the victim's MCP Atlassian callback endpoint with a malicious error parameter containing HTML or script payloads. The attacker delivers the link through phishing, a malicious page, or by manipulating an OAuth authorization server response. When the victim clicks the link or completes an attacker-initiated OAuth flow, the injected script executes in their browser with access to any tokens, cookies, or data available to the callback origin.

python

# Vulnerable pattern (conceptual): the OAuth error query parameter
# reaches CallbackHandler._send_response and is written into HTML
# without escaping, allowing reflected XSS via a crafted callback URL.
#
# Fixed in MCP Atlassian v0.22.0. See patch:
# https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460

Source: GitHub Security Advisory GHSA-g2r2-3j32-j27x

Detection Methods for CVE-2026-77272

Indicators of Compromise

Requests to the MCP Atlassian OAuth callback path containing an error query parameter with HTML tags, angle brackets, javascript: schemes, or event handler attributes such as onerror= and onload=.
Access logs showing unusually long or URL-encoded error parameter values referencing <script>, <img, <svg, or document.cookie.
Outbound browser requests from callback pages to unknown domains shortly after an OAuth flow completes.

Detection Strategies

Deploy a web application firewall rule that inspects the error query parameter on the OAuth callback route and blocks payloads containing angle brackets or script keywords.
Search HTTP proxy and reverse-proxy telemetry for callback requests where the error parameter deviates from the standard OAuth 2.0 error code set (access_denied, invalid_request, server_error, etc.).
Instrument the MCP Atlassian process to log and alert on any callback where the error value fails a strict alphanumeric-plus-underscore allow list.

Monitoring Recommendations

Correlate OAuth callback anomalies with subsequent authenticated actions against Jira and Confluence tenants tied to the same user session.
Monitor MCP Atlassian version banners across the environment to identify hosts still running releases below 0.22.0.
Track referrer headers on callback requests to identify OAuth flows initiated from unexpected external origins.

How to Mitigate CVE-2026-77272

Immediate Actions Required

Upgrade MCP Atlassian to version 0.22.0 or later on every host running the server component.
Rotate any OAuth tokens, refresh tokens, and Atlassian API credentials that may have been exposed during sessions completed on vulnerable versions.
Restrict network access to the OAuth callback listener so only trusted browsers on trusted networks can reach it during setup.

Patch Information

The fix is included in MCP Atlassian v0.22.0. The maintainers applied the correction in commit b041733473f95119dd539542a43c280737a8e460 and merged it through pull request #1448. Review the GitHub Release v0.22.0, the remediation commit, and the GitHub Security Advisory GHSA-g2r2-3j32-j27x before deploying.

Workarounds

Terminate the OAuth setup listener when not actively authorizing MCP Atlassian against Confluence or Jira.
Place the callback endpoint behind a reverse proxy that strips or validates the error query parameter against the OAuth 2.0 error code allow list.
Instruct operators to complete OAuth setup only in a clean browser profile with no active Atlassian session cookies, minimizing the value of any stolen tokens.

bash

# Upgrade MCP Atlassian to the patched release
pip install --upgrade "mcp-atlassian>=0.22.0"

# Verify the installed version is 0.22.0 or later
python -c "import importlib.metadata as m; print(m.version('mcp-atlassian'))"