MCP Atlassian EUVD-2026-84626

Exploitation requires the attacker to already be a permitted MCP client of a mcp-atlassian server (< 0.22.0) that has ENABLED_TOOLS and/or TOOLSETS configured to enforce least-privilege tool restrictions - the flaw only matters where an operator relies on those settings to hide read/write/delete tools. The attacker must also know (or guess, from standard MCP tool-naming conventions) the exact name of an excluded tool, then issue a direct tools/call request; enforcement is absent at dispatch (_call_tool_mcp) because it is only applied during tools/list. Limiting factors: PR:L means an unauthorized outsider cannot exploit it, and deployments that do not restrict toolsets (all tools already enabled) have nothing to bypass. Highest impact in shared-credential or multi-tenant deployments where the toolset filter is the trust boundary.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8 HIGH) is internally consistent with the description: a network-reachable authorization flaw where a low-privileged but permitted MCP caller (PR:L) can, with low complexity and no user interaction, invoke Confluence/Jira read, write, and delete tools the operator deliberately excluded via ENABLED_TOOLS/TOOLSETS - hence full C:H/I:H/A:H against Atlassian data. No EPSS score, KEV listing, or POC was provided, so this is 'no public exploit identified at time of analysis'; the high base score reflects impact, not demonstrated wild exploitation. Real-world risk is materially gated by two factors the raw score does not capture: the attacker must already be an authorized MCP client of this specific server (PR:L, not an anonymous internet attacker), and must know the exact name of a hidden/excluded tool - though tool names in MCP servers are well-known conventions, so this is a weak secret. This is a genuine least-privilege/defense-in-depth bypass rather than a full pre-auth breach; priority is real for anyone running mcp-atlassian in a multi-tenant or shared-credential deployment where toolset restrictions are the primary access-control boundary, but low for single-trusted-operator local deployments. The product is a niche, emerging open-source MCP server, which lowers aggregate exposure independent of severity.

An operator deploys mcp-atlassian with a least-privilege TOOLSETS/ENABLED_TOOLS configuration exposing only read tools to a given MCP client. A permitted-but-restricted client crafts a tools/call request naming an excluded write or delete tool (e.g. a Jira issue-delete or Confluence page-write tool) directly; because enforcement happens only at tools/list and is never re-checked at dispatch, the call executes with the server's Atlassian credentials. No public exploit code was identified, but the primitive is trivial to reproduce given a known tool name.