CVE-2026-77251 in mcp-atlassian
Summary
by MITRE • 09/22/2026
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira search accepts a forbidden project clause because it checks only for the presence of project syntax, Confluence search uses an incomplete case-sensitive space check, and Jira board APIs omit project-filter enforcement. These paths expose issues, boards, or pages outside JIRA_PROJECTS_FILTER or CONFLUENCE_SPACES_FILTER when the operator credentials have broader access. The advisory traces the vulnerable input and processing flow through jira_search, confluence_search, get_board_issues, get_agile_boards, JIRA_PROJECTS_FILTER, and CONFLUENCE_SPACES_FILTER, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified within MCP Atlassian versions prior to 0.22.0 represents a critical failure in access control enforcement mechanisms designed to restrict user interactions with specific subsets of Jira projects and Confluence spaces. As a Model Context Protocol server, this tool acts as an intermediary between large language models and Atlassian infrastructure, relying on configuration filters such as the JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER to limit operational scope. The core technical flaw stems from inconsistent validation logic across different API endpoints and search functionalities within the application layer. Specifically, the implementation fails to rigorously enforce these boundary constraints during query processing, allowing authenticated operators with broad underlying permissions in Atlassian products to bypass intended restrictions and access unauthorized resources.
In the Jira component, two distinct failure modes were identified that compromise data isolation. First, the jira_search function exhibits a logic error where it validates only for the presence of project syntax rather than verifying whether the specified project is actually permitted by the configured filter. This superficial check allows an attacker to construct search queries targeting any project ID or key, regardless of its inclusion in the allowed list. Second, the Agile board APIs, specifically get_board_issues and get_agile_boards, completely omit project-filter enforcement. These endpoints directly retrieve data based on board identifiers without cross-referencing against the JIRA_PROJECTS_FILTER configuration. Consequently, if an operator has access to a restricted board or can infer its identifier through enumeration, they can extract issues from projects that should be strictly off-limits according to the MCP server's security policy.
The Confluence component suffers from a similar but distinct implementation flaw related to space filtering. The confluence_search function employs an incomplete case-sensitive check for spaces when validating input against the CONFLUENCE_SPACES_FILTER. This vulnerability likely arises from improper string comparison logic that fails to normalize or correctly match space identifiers under certain conditions, such as variations in casing or whitespace handling. As a result, search queries targeting Confluence pages outside the designated allowed spaces may succeed if they exploit this parsing inconsistency. This allows unauthorized retrieval of content and metadata from restricted documentation areas, effectively bypassing the intended scope limitations imposed by the system administrator.
The operational impact of these vulnerabilities is significant for organizations relying on MCP Atlassian to manage AI-driven interactions with their development and collaboration tools. By exploiting these flaws, an attacker or malicious insider can perform horizontal privilege escalation within the context of the MCP server's configuration. They gain access to sensitive project data, issue trackers, board histories, and confidential Confluence pages that were explicitly excluded from the model's operational scope. This exposure violates the principle of least privilege and compromises the confidentiality integrity of organizational assets managed through Atlassian platforms. The vulnerability aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if filters are misconfigured, as well as MITRE ATT&CK techniques related to Discovery and Collection via API abuse.
To mitigate these risks, organizations must immediately upgrade MCP Atlassian to version 0.22.0 or later, where the validation logic has been corrected to strictly enforce project and space boundaries across all affected endpoints including jira_search, confluence_search, get_board_issues, and get_agile_boards. In addition to patching, administrators should audit their JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER configurations to ensure they are comprehensive and correctly formatted. It is also recommended to implement network-level controls or API gateways that enforce secondary validation of resource access requests, providing a defense-in-depth strategy against logic flaws in application-layer filtering mechanisms. Regular security assessments should include testing for improper access control vulnerabilities in any middleware interacting with enterprise software APIs.