sooperset mcp-atlassian up to 0.21.x Jira Search/Confluence Search/Board APIs privileges management

Summaryinfo

A vulnerability labeled as problematic has been found in sooperset mcp-atlassian up to 0.21.x. Affected is the function jira_search/confluence_search/get_board_issues/get_agile_boards of the component Jira Search/Confluence Search/Board APIs. Such manipulation leads to privileges management. This vulnerability is uniquely identified as CVE-2026-77251. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in sooperset mcp-atlassian up to 0.21.x. It has been rated as problematic. Affected by this issue is the function jira_search/confluence_search/get_board_issues/get_agile_boards of the component Jira Search/Confluence Search/Board APIs. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality. CVE summarizes:

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira search accepts a forbidden project clause because it checks only for the presence of project syntax, Confluence search uses an incomplete case-sensitive space check, and Jira board APIs omit project-filter enforcement. These paths expose issues, boards, or pages outside JIRA_PROJECTS_FILTER or CONFLUENCE_SPACES_FILTER when the operator credentials have broader access. The advisory traces the vulnerable input and processing flow through jira_search, confluence_search, get_board_issues, get_agile_boards, JIRA_PROJECTS_FILTER, and CONFLUENCE_SPACES_FILTER, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-77251 since 08/20/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 0.22.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• sooperset

Name

• mcp-atlassian

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21

Website

• Product: https://github.com/sooperset/mcp-atlassian/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion