MCP Atlassian CVE-2026-77248

Requires the MCP Atlassian server (< 0.22.0) to be running the streamable-HTTP transport and reachable by the attacker over the network, AND to be configured with global/operator Atlassian (Jira/Confluence) credentials that the UserTokenMiddleware falls back to when no user identity is supplied. Under those conditions no authentication is needed and default HTTP-transport behavior is sufficient (AV:N/AC:L/PR:N/UI:N). Exploitation is LIMITED to files readable by the MCP process account, and does not apply to stdio-only deployments or deployments that require per-user identity/tokens; there is no integrity or availability impact (confidentiality-only exfiltration).

This is a genuine remote-unauthenticated arbitrary file read with real teeth, but its practical priority is bounded by product footprint rather than by exploit maturity. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) is internally coherent with the description: the streamable-HTTP transport accepts requests with no user identity and silently falls back to shared operator credentials, so PR:N is legitimately earned here - unlike the sibling file-read CVEs in the same PR#1448 batch (e.g. CVE-2026-77260/77253/77247) which required a permitted caller (PR:L). The auth-bypass fallback (root flaw CVE-2026-77244) is what promotes this from an authenticated confused-deputy issue to a fully unauthenticated one. I would question the vendor's S:C: the impact is reading files within the MCP process's own authority and re-exporting them, which is arguably S:U; treating it as S:U lowers my independent estimate to ~7.5. There is NO EPSS score, NO CISA KEV listing, and NO public exploit code referenced - only a GitHub Security Advisory, PR, commit, and release. So exploitation status is 'no public exploit identified at time of analysis.' Net: the vulnerability class and unauth vector are serious and should be patched promptly wherever this MCP server is exposed over HTTP, but the absence of exploitation signals plus the niche deployment footprint means this is a targeted-opportunity risk, not a mass-exploitation emergency.

An MCP Atlassian server (< 0.22.0) is deployed with the streamable-HTTP transport reachable on the network and configured with shared operator Jira/Confluence credentials. An unauthenticated attacker who can reach the endpoint invokes upload_attachment with file_path set to a sensitive host file (e.g. an env file, OAuth token store, or mounted secret), targeting an attacker-chosen Jira issue or Confluence page, then downloads that attachment to retrieve the file contents. No public exploit code is referenced, but the flow is trivial to reproduce given the low attack complexity.