{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aatlassianmcp-atlassian/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:atlassian:mcp-atlassian:*:*:*:*:*:*:*:*","cpe:2.3:a:mcp-atlassian:mcp_atlassian:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-77244"},{"cvss":9,"id":"CVE-2026-27825"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mcp-atlassian (\u003c 0.22.0)","mcp-atlassian"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","api-security","atlassian","mcp","path-traversal","ai-security","exfiltration","vulnerability","authorization-bypass","cve-2026-77243","remote-code-execution","data-exfiltration","jira","confluence","filter-bypass","cve","credential-theft"],"_cs_type":"advisory","_cs_vendors":["Atlassian"],"content_html":"\u003cp\u003eThe \u003ccode\u003emcp-atlassian\u003c/code\u003e Python package is vulnerable to a critical authentication bypass (CVE-2026-77244) due to improper validation in the \u003ccode\u003eAtlassianOpaqueTokenVerifier\u003c/code\u003e utility. The implementation of \u003ccode\u003everify_token()\u003c/code\u003e explicitly accepts any non-empty string as a valid credential. Furthermore, the \u003ccode\u003emcp-atlassian\u003c/code\u003e HTTP transport defaults to disabled OAuth proxy authentication and fails to reject requests lacking an \u003ccode\u003eAuthorization\u003c/code\u003e header.\u003c/p\u003e\n\u003cp\u003eWhen deployed in the standard pattern (storing \u003ccode\u003eJIRA_API_TOKEN\u003c/code\u003e or \u003ccode\u003eCONFLUENCE_API_TOKEN\u003c/code\u003e in environment variables), the MCP server fails to challenge unauthenticated requests. Instead, it proceeds to invoke Jira/Confluence tool handlers using the server-side environment variables. An attacker with network reach to the MCP server can send arbitrary requests - or no credentials at all - to perform unauthorized operations on the operator's Atlassian instance. This vulnerability is significant because it grants attackers the full API privileges of the server operator, including read and write access to all accessible Jira issues and Confluence pages.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs network discovery to identify an \u003ccode\u003emcp-atlassian\u003c/code\u003e HTTP transport instance reachable on the network (e.g., via default Docker port mappings or misconfigured cloud load balancers).\u003c/li\u003e\n\u003cli\u003eAttacker crafts a JSON-RPC request targeting the \u003ccode\u003e/mcp\u003c/code\u003e endpoint with the desired tool execution parameters (e.g., \u003ccode\u003ejira_get_issue\u003c/code\u003e or \u003ccode\u003ejira_add_comment\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe request is transmitted to the server without an \u003ccode\u003eAuthorization\u003c/code\u003e header, or with a dummy \u0026quot;Bearer\u0026quot; token.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eUserTokenMiddleware._parse_auth_header\u003c/code\u003e processes the request; seeing no valid client token, it passes the request context to the internal handlers without rejection.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eAtlassianOpaqueTokenVerifier\u003c/code\u003e receives the request; if a dummy token is provided, it is accepted by the logic that validates only that the string is non-empty.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eJiraFetcher\u003c/code\u003e or \u003ccode\u003eConfluenceFetcher\u003c/code\u003e detects the absence of a user-supplied token in the scope state and initiates \u003ccode\u003eJiraConfig.from_env()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe server retrieves the operator's \u003ccode\u003eJIRA_API_TOKEN\u003c/code\u003e or \u003ccode\u003eCONFLUENCE_API_TOKEN\u003c/code\u003e from the process environment variables.\u003c/li\u003e\n\u003cli\u003eThe tool execution is performed against the Atlassian cloud backend using the operator's identity, resulting in data exfiltration, unauthorized modification, or persistent access creation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants an attacker full read and write access to the operator's Jira and Confluence instances. Because all API calls are made using the operator's legitimate credentials, the attacker's actions appear as authenticated operator activity in Atlassian audit logs, facilitating anti-forensics and shifting blame to the victim. Furthermore, attackers can leverage the MCP server to pivot, exfiltrate sensitive data stored in attachments or documentation, and create persistent backdoors via Jira webhooks or automation rules.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003emcp-atlassian\u003c/code\u003e package to version 0.22.0 or later immediately to patch CVE-2026-77244.\u003c/li\u003e\n\u003cli\u003eFor deployments not using OAuth proxy, implement strict network-level access control (e.g., firewall rules or mTLS) to restrict access to the MCP server to authorized users only.\u003c/li\u003e\n\u003cli\u003eIf version 0.22.0 is not immediately available, disable public exposure of the HTTP transport by binding the service to \u003ccode\u003e127.0.0.1\u003c/code\u003e and utilizing a secure reverse proxy (e.g., Nginx or Traefik) that enforces authentication before forwarding traffic to the MCP server.\u003c/li\u003e\n\u003cli\u003eAudit Jira and Confluence audit logs for anomalous tool execution patterns or unauthorized modification of issues and automation rules originating from the host IP of the MCP server.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-23T01:58:41Z","date_published":"2026-09-23T01:54:36Z","id":"https://feed.craftedsignal.io/briefs/2026-09-mcp-atlassian-auth-bypass/","summary":"The mcp-atlassian package contains an authentication bypass vulnerability (CVE-2026-77244) that allows unauthenticated network-adjacent attackers to execute tools using the operator's Jira and Confluence credentials.","title":"Authentication Bypass in mcp-atlassian HTTP Transport","url":"https://feed.craftedsignal.io/briefs/2026-09-mcp-atlassian-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:atlassian:mcp-Atlassian:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}