MCP Atlassian EUVD-2026-84607

Exploitation requires the mcp-atlassian server to be running in HTTP (streamable-http) transport mode AND configured with the operator's globally-set Jira/Confluence credentials AND the MCP endpoint to be network-reachable by the attacker - the shared-credential/multi-tenant deployment pattern. Under those conditions no authentication, user interaction, or special privilege is needed (AV:N/AC:L/PR:N/UI:N): a network client simply invokes Atlassian tools and inherits the operator's read/write access. Limiting factors: stdio-transport deployments and per-user token deployments that do not fall back to global credentials are not exposed, so this is not universally exploitable against every install of the product.

This is a genuine top-priority issue where the CVSS signal and the technical facts agree rather than conflict. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N (vendor 10.0, CWE-287) is fully supported by the description: the HTTP streamable-http transport accepts requests without a verified user identity and falls back to the operator's globally configured Jira/Confluence credentials, so any network client reaching the endpoint acts as the operator with read and write access. PR:N is justified because no authentication is verified; S:C is justified because the MCP server compromises the separate, downstream Atlassian tenant (a different security authority). A:N is correct - the flaw exposes/modifies data but does not itself deny service. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is NOT confirmed active exploitation despite the maximal CVSS. The one factor that meaningfully lowers real-world risk is deployment gating (see exploitation_conditions): the flaw only bites when the server runs in HTTP transport mode with operator-global credentials configured and the endpoint is network-reachable, which is the multi-tenant/shared-credential pattern, not every install. Note this CVE is the ROOT of a batch: siblings CVE-2026-77258 (path traversal) and CVE-2026-77274 (SSRF), all fixed in the same PR #1448, chain off this unauthenticated access.

An operator deploys mcp-atlassian in HTTP (streamable-http) transport with a global Jira/Confluence service account and exposes the endpoint on a reachable network. An attacker who can reach that endpoint sends MCP tool-invocation requests without any credential; because user identity is never verified, the fetcher is built from the operator's global tokens, letting the attacker read and modify Confluence pages and Jira issues as that account. No public exploit code is identified, but the attack requires only well-formed network requests (AC:L).