MCP Atlassian EUVD-2026-84623

Exploitation requires that the MCP Atlassian server (sooperset/mcp-atlassian, versions prior to 0.22.0) be deployed with administrator-configured allowlists set via JIRA_PROJECTS_FILTER and/or CONFLUENCE_SPACES_FILTER, AND that the shared/operator Atlassian credential the server uses can access projects or spaces BEYOND that allowlist. The attacker must already be an authorized MCP caller (PR:L) able to invoke jira_search/confluence_search and supply projects_filter/spaces_filter arguments or explicit project/space clauses; the pre-fix code let those caller arguments REPLACE the config allowlist and let a caller-supplied space clause suppress the restriction. Limiting factors: the attack yields nothing if the operator credential is already scoped to exactly the allowlisted projects/spaces (no broader access to reach), and it grants read-only exposure with no write or availability impact. Not exploitable by fully unauthenticated network attackers.

This is a genuine but bounded authorization-boundary flaw, not a high-CVSS-but-low-risk artifact - yet also not an emergency. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5 MEDIUM) is internally consistent with the description: PR:L correctly reflects that the attacker must already be a permitted MCP caller, and the confidentiality-only impact (C:H, I:N, A:N) matches a search-filter bypass that reads data but does not modify it. No EPSS score, no CISA KEV entry, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The realistic risk is gated by two conditions the CVSS score cannot express: the deployment must use a shared/operator Atlassian credential whose access is BROADER than the configured allowlist, and the attacker must already be an authorized caller of the MCP server. The one data-quality conflict worth flagging: the input Tags label this 'Authentication Bypass,' but the CWE (CWE-284), the description ('search outside the intended boundary'), and the CVSS PR:L all indicate an AUTHORIZATION/allowlist-enforcement bypass by an already-authenticated caller - not an authentication bypass. Bottom line: prioritize for environments running MCP Atlassian with over-privileged shared credentials, but treat as routine patching elsewhere.

In a shared-credential MCP Atlassian deployment where the operator configured JIRA_PROJECTS_FILTER/CONFLUENCE_SPACES_FILTER to restrict callers to a subset of projects, an authorized-but-limited caller invokes jira_search or confluence_search and passes its own projects_filter/spaces_filter argument (or embeds an explicit project/space clause) that replaces or suppresses the administrator's allowlist. Because the underlying Atlassian credential can reach additional projects and spaces, the caller retrieves issues and pages outside its intended boundary. No public exploit code is identified, but the technique requires only a crafted tool argument, consistent with the AC:L rating.