MCP Atlassian CVE-2026-77251

Requires an authenticated/permitted caller of the MCP-Atlassian server (PR:L) in a deployment where the server's operator credentials (the shared Jira/Confluence tokens) grant access broader than the configured JIRA_PROJECTS_FILTER or CONFLUENCE_SPACES_FILTER. The vulnerability is only meaningful when those allowlist filters are actually configured to restrict access AND the underlying operator account can see more than the filter permits - i.e., shared-credential, multi-tenant, or delegated MCP deployments. Exploitation needs no user interaction and no special network conditions beyond reaching the MCP endpoint; the limiting factors are the requirement to be an accepted MCP client and the existence of a configured-but-narrower filter over broadly-scoped operator credentials. Affected versions are prior to 0.22.0.

This is a moderate-priority authorization/filter-bypass information-disclosure flaw, not a top-tier emergency. The CVSS 4.0 vector (8.3, AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H) tells a consistent story: network-reachable, low complexity, but requires low privileges (PR:L - an already-permitted MCP caller) and yields confidentiality impact only (VI:N/VA:N - no integrity or availability loss). The high base score is driven by VC:H combined with the subsequent-system scope change (SC:H), reflecting that the MCP server acts as a confused deputy using operator credentials that are broader than the caller should reach. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic risk is bounded by deployment model: it only matters in shared-credential MCP deployments where operator tokens have access beyond the configured JIRA_PROJECTS_FILTER/CONFLUENCE_SPACES_FILTER. Note a metadata tension worth verifying: the assigned CWE-1276 ('Hardware Child Block Incorrectly Connected to Parent System') does not fit a software JQL/CQL filter-bypass - the behavior is squarely incorrect-authorization (CWE-863/CWE-284). This does not change the risk but flags an inaccurate classifier.

In a multi-user or shared-credential MCP-Atlassian deployment, an authenticated but restricted caller issues a Jira search with a crafted project clause (or a Confluence search abusing the case-sensitive space check, or calls get_board_issues/get_agile_boards), and because the server only checks for the presence of project syntax rather than enforcing the allowlist, it returns issues, boards, and pages from projects/spaces outside JIRA_PROJECTS_FILTER/CONFLUENCE_SPACES_FILTER. The attacker thereby reads confidential Atlassian content the operator credentials can see but the caller was never authorized for. No public proof-of-concept is referenced, though the fixing PR #1448 and commit b0417334 detail the exact vulnerable code paths.