CVE-2026-77246 in mcp-atlassian
Summary
by MITRE • 09/22/2026
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, an HTTP transport deployment with READ_ONLY_MODE=false accepts a request without an Authorization identity and permits attacker-controlled Atlassian service headers, including X-Atlassian-Confluence-Url, to select a public attacker hostname or one allowed by MCP_ALLOWED_URL_DOMAINS. A caller can then invoke confluence_upload_attachment or the Jira attachment variant in src/mcp_atlassian/jira/attachments.py with a server-local file_path and cause the MCP process to send the file to the selected attachment endpoint. This issue is fixed in version 0.22.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Atlassian Model Context Protocol servers prior to version 0.22.0 represents a critical authentication bypass combined with an insecure direct object reference mechanism that facilitates unauthorized data exfiltration. The core of the issue lies in the HTTP transport configuration where the READ_ONLY_MODE flag is set to false, effectively enabling write operations within the MCP server environment. Under these conditions, the application fails to enforce strict identity verification for incoming requests, allowing unauthenticated callers to interact with sensitive endpoints. This lack of authentication control creates a direct pathway for attackers to manipulate internal service headers, specifically targeting attributes such as X-Atlassian-Confluence-Url which dictate where data is transmitted within the Atlassian ecosystem.
The technical flaw exploits the server's ability to accept attacker-controlled header values that override default routing behaviors. By injecting malicious URLs into these headers, an adversary can redirect file upload operations away from legitimate internal endpoints toward domains they control or those permitted by the MCP_ALLOWED_URL_DOMAINS configuration variable. This mechanism effectively turns the MCP process into a proxy for data theft, as it trusts the destination specified in the header without validating whether that destination is authorized for such transfers. The vulnerability leverages the trust relationship between the MCP server and Atlassian services to execute actions on behalf of an unauthenticated user, bypassing standard access controls designed to protect sensitive project data.
Operational impact centers on the potential for significant data leakage through file exfiltration. An attacker can invoke specific functions such as confluence_upload_attachment or its Jira counterpart located in src/mcp_atlassian/jira/attachments.py by providing a server-local file_path parameter. This action causes the MCP process to read files from the local system and transmit them to an external endpoint selected via the manipulated headers. Consequently, sensitive documents, configuration files, or proprietary information stored on the host machine can be exfiltrated without detection by traditional perimeter security measures that do not inspect internal application logic for header manipulation. The ability to select public attacker-hosted destinations ensures that stolen data is immediately removed from the protected environment and accessible to malicious actors.
This vulnerability aligns with CWE-287, which describes Improper Authentication, as the system fails to properly verify the identity of a user attempting to access resources. It also relates closely to CWE-913, Improper Control of Dynamically-Managed Code Resources, due to the manipulation of dynamic header values that influence application behavior. From an ATT&CK perspective, this exploit maps to T1048 Exfiltration Over Alternative Protocol and potentially T1567 Exfiltration to Cloud Storage if the attacker utilizes cloud-based endpoints for data reception. The attack vector is classified as Network-Based since it relies on HTTP requests transmitted over a network connection rather than local system access or physical interaction.
Mitigation strategies must prioritize immediate version upgrades to 0.22.0 or later, where these authentication and header validation flaws have been addressed by the vendor. In environments where upgrading is not immediately feasible, administrators should enforce READ_ONLY_MODE=true in all production deployments to disable write operations entirely, thereby neutralizing the ability to upload files regardless of other configuration settings. Additionally, strict input validation must be implemented for all HTTP headers received from clients, ensuring that values such as X-Atlassian-Confluence-Url are validated against a whitelist of known safe domains rather than relying on broad allowlists like MCP_ALLOWED_URL_DOMAINS which may inadvertently include malicious targets. Network segmentation and monitoring should also be employed to detect unusual outbound traffic patterns associated with large file transfers initiated by the MCP service process.