---
id: 2026-09-mcp-atlassian-cve-mass-assignment
title: "mcp-atlassian — the most-used Atlassian MCP server (161K weekly PyPI downloads) got 26 CVEs assigned at once on 2026-09-22 for the security audit it shipped back in July: headline is CVE-2026-77244, a CVSS 10.0 unauthenticated auth bypass (any non-empty token is accepted, then falls back to the operator's global Jira/Confluence credentials); all fixed in 0.22.0, current 0.23.1"
date_disclosed: 2026-07-10
last_updated: 2026-09-23
severity: critical
status: patched
ecosystems: [pypi, mcp]
tools_affected: ["mcp-atlassian < 0.22.0 (Jira / Confluence MCP server)"]
tags: [cve-batch, mcp, authentication-bypass, ssrf, path-traversal, confused-deputy, credential-theft, prompt-injection, patched]
---

## TL;DR
`mcp-atlassian` (sooperset) is the most widely deployed Model Context Protocol server for Jira and Confluence — ~161K PyPI downloads a week, 4M+ all-time. On **2026-07-10** the maintainer shipped **0.22.0**, a "comprehensive security audit" that closed **37 advisories** at once. Those advisories carried no CVE ids at the time; on **2026-09-22** GitHub (as CNA) assigned a block of **26 CVEs** (CVE-2026-77243 through CVE-2026-77274, plus the two February ids CVE-2026-27825/-27826) and pushed them into the advisory database, which is why the server reappears across every recency-sorted sweep this week looking like a fresh wave. It is not: **everything here is fixed in 0.22.0** (with follow-on hardening in 0.22.1 / 0.23.0 / 0.23.1; current release 0.23.1, 2026-08-19). The one entry that must not be missed is **CVE-2026-77244 (CVSS 10.0)**: in HTTP transport the token verifier accepts **any non-empty string**, and when no auth provider is built the server **falls back to the operator's globally configured Jira/Confluence credentials** — an unauthenticated network client gets full operator-level Jira/Confluence access. If you patched to ≥ 0.22.0 in July you are done; if you are still on an older HTTP-transport deployment, this is the reason to upgrade today. This repo already tracked one member of the July batch (CVE-2026-73498) in the [MCP CVE batch](2026-08-agent-framework-mcp-cve-batch.md) and the February MCPwnfluence pair (CVE-2026-27825/-27826) in the [stdio systemic-RCE advisory](2026-05-mcp-stdio-systemic-rce.md); this file is the full September CVE assignment.

## What happened

**A July fix, a September CVE block.** The maintainer's 0.22.0 release notes describe resolving 37 advisories: "path confinement for attachments/content files; HTTP transport authentication boundary enforcement; SSRF hardening with DNS-pinning; tool authorization enforcement; filter boundary protection; OAuth token file permissions (0600); and reflected XSS prevention." All 37 were published as GitHub Security Advisories on 2026-07-10 with severity labels but no CVE numbers. GitHub assigned CVEs to 26 of them on 2026-09-22 and the advisory database mirrored them the same day. Per this repo's standing rule, a **database-publication date is not a disclosure date** — the disclosure and the fix are both July; the CVEs are a late-assigned identifier layer. NVD confirms CVE-2026-77244 was published 2026-09-22 by GitHub with the vendor commit, PR #1448 and the v0.22.0 tag as references.

**The classes, and what each lets an attacker do.** The 26 CVEs collapse into the four failure modes this repo has documented across ~30 MCP servers — an HTTP surface that is open by default, a path argument that isn't confined, an SSRF guard that isn't applied on every branch, and an authorization check enforced at list time but not at call time:

| CVE | CVSS | Class |
|---|---|---|
| CVE-2026-77244 | **10.0 Critical** | Auth bypass: `AtlassianOpaqueTokenVerifier.verify_token()` accepts any non-empty token; HTTP transport then falls back to global operator credentials |
| CVE-2026-77254 (GHSA-vc8m-84rp-53hx) | 9.1 Critical | Unauthenticated HTTP requests use globally configured Jira/Confluence credentials (binds `0.0.0.0`, POST without `Authorization` passes) |
| CVE-2026-27825 | 9.0 Critical | Arbitrary file write via unconstrained `download_path` in `confluence_download_attachment` → RCE on restart |
| CVE-2026-77243 | 8.8 High | `ENABLED_TOOLS` / `TOOLSETS` authorization bypass: list-time filtered, call-time not — any of 73 tools invokable |
| CVE-2026-77248 | 8.6 High | Unauthenticated arbitrary local file read via `upload_attachment` `file_path` |
| CVE-2026-77255 | 8.6 High | Confused-deputy arbitrary file read in JIRA `update_issue` attachments — an agent forces the privileged MCP process to read `JIRA_API_TOKEN` and host secrets |
| CVE-2026-77247 / -77246 / -77262 | 8.3 / 7.4 / 8.6 | Path traversal / server-local file exfiltration via attachment tools |
| CVE-2026-27826 | 8.2 High | SSRF via unvalidated `X-Atlassian-Jira-Url` / `X-Atlassian-Confluence-Url` headers |
| CVE-2026-77274 | 8.2 High | SSRF protection bypass |
| CVE-2026-77271 | 7.7 High | Incomplete path-traversal fix → intra-CWD module overwrite → RCE (`validate_safe_path()` defaults to `os.getcwd()`) |
| CVE-2026-77257 / -77258 / -77259 / -77260 / -77251 / -77267 | 7.7 High | HTTP upload path acceptance, credential-exfil file reads, project/space filter authorization bypass, incomplete SSRF remediation |
| CVE-2026-77249 / -77253 / -77261 / -77265 / -77266 / -77268 / -77269 / -77270 / -77250 / -77272 | 5.3–7.1 | SSRF (DNS-rebinding), moderate path traversals, insecure OAuth token file permissions, reflected XSS in the OAuth setup callback |

The two Critical HTTP-transport CVEs are the ones that matter for a reader who only reads the headline: an `mcp-atlassian` HTTP endpoint reachable on the network before 0.22.0 is **operator-level Jira/Confluence access with no credential**. The confused-deputy and path-traversal reads (CVE-2026-77255, -77248, -77260) are the agent-specific ones: a prompt-injected agent, or a low-privilege MCP client, drives the privileged server process to read `JIRA_API_TOKEN`, host config and other secrets the agent's own sandbox would deny.

**Version map (PyPI `time`, fetched 2026-09-23).** The vulnerable range for the whole batch is **< 0.22.0**. Fixes and hardening: **0.22.0** (2026-07-10, the audit), **0.22.1** (2026-07-11, JQL-injection and SSRF hardening), **0.23.0** (2026-07-18, Starlette bump + FastMCP 3.x migration), **0.23.1** (2026-08-19, fixes CVE-less GHSA-5j8j-256g-vvp5 — an unauthenticated SSE-transport tool-execution bug where the auth middleware only matched `/mcp`, not `/sse` and `/messages/`). Current release is **0.23.1**.

## Am I affected?

```bash
pip show mcp-atlassian 2>/dev/null | grep -i '^version'      # < 0.22.0 = the whole batch; < 0.23.1 = also the SSE bug
pip index versions mcp-atlassian 2>/dev/null | head -1
# If you run the HTTP or SSE transport, is it reachable and does it hold global creds?
env | grep -E 'CONFLUENCE_API_TOKEN|JIRA_API_TOKEN|ATLASSIAN'   # global fallback creds = the blast radius of CVE-2026-77244/-77254
ss -tlnp 2>/dev/null | grep -E '0\.0\.0\.0|:::' | grep -i python   # bound to all interfaces?
```

- **Affected if:** you run `mcp-atlassian < 0.22.0`, and especially if its `--transport streamable-http` / `--transport sse` listener is reachable beyond loopback with `CONFLUENCE_API_TOKEN` / `JIRA_API_TOKEN` set — that is unauthenticated operator access (CVE-2026-77244, 10.0).
- **Not affected / already fixed if:** you upgraded to **≥ 0.22.0** in July (all 26 CVEs) — go to **0.23.1** to also close the August SSE bug. stdio-transport-only local use was never exposed to the network CVEs but was to the path-traversal file reads.

## If you are affected

- Upgrade to **0.23.1** now; there is no partial fix. If you cannot upgrade immediately, take the HTTP/SSE listener off `0.0.0.0`, put it behind an authenticating proxy, and unset the global credential fallback.
- Because the pre-0.22.0 HTTP transport could be used with the operator's Jira/Confluence token by anyone who reached it, **rotate `CONFLUENCE_API_TOKEN` / `JIRA_API_TOKEN`** if the listener was ever network-reachable, and review Jira/Confluence audit logs for actions you cannot attribute — [rotating-cloud-credentials.md](../playbooks/rotating-cloud-credentials.md), [if-an-mcp-server-was-malicious.md](../playbooks/if-an-mcp-server-was-malicious.md).

## Prevention

- **Never expose an MCP server's HTTP/SSE transport on `0.0.0.0` without an auth proxy** — the recurring root cause in this repo's MCP tracking. [prevention/mcp-hygiene.md](../prevention/mcp-hygiene.md).
- **A "patched" version number is not the same as a CVE**: this batch was fixed for two months before it had CVE ids, so a CVE-feed-only monitor would have flagged it in September while the fix had been available since July. Track the vendor's advisory tab and release notes, not just NVD. [prevention/supply-chain-attack-surface.md](../prevention/supply-chain-attack-surface.md).
- Treat a privileged MCP server as a confused deputy: an agent that can call its tools can make it read files the agent itself cannot. Give the server the narrowest credential and filesystem scope it can run with.

## Sources
- [NVD — CVE-2026-77244](https://nvd.nist.gov/vuln/detail/CVE-2026-77244) — fetched via the NVD API 2026-09-23: CVSS 3.1 10.0 (`AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N`), published 2026-09-22 by GitHub, affected < 0.22.0, references the vendor commit `b041733`, PR #1448 and the v0.22.0 tag.
- [GitHub Advisory Database — GHSA-wrhw-j3f9-8vc6 (CVE-2026-77244)](https://github.com/advisories/GHSA-wrhw-j3f9-8vc6), [GHSA-vc8m-84rp-53hx (CVE-2026-77254)](https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc8m-84rp-53hx), [GHSA-3r68-hf9h-887v (CVE-2026-77243)](https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-3r68-hf9h-887v), [GHSA-2xj6-xx86-cwwc (CVE-2026-77255)](https://github.com/advisories/GHSA-2xj6-xx86-cwwc), [GHSA-6vmq-24h2-pj7j (CVE-2026-77271)](https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-6vmq-24h2-pj7j), [GHSA-5j8j-256g-vvp5 (SSE transport, 0.23.1)](https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-5j8j-256g-vvp5) — fetched 2026-09-23: CVSS scores, affected/patched ranges, mechanism descriptions, credits (VinSOC Labs, @b-hermes, @hypnguyen1209).
- [sooperset/mcp-atlassian — Security Advisories index (4 pages, 37 advisories)](https://github.com/sooperset/mcp-atlassian/security/advisories) — walked directly 2026-09-23: all dated 2026-07-10 except the two 2026-02-24 entries (CVE-2026-27825/-27826) and the 2026-08-19 SSE bug.
- [GitLab Advisory Database — mcp-atlassian](https://advisories.gitlab.com/pypi/mcp-atlassian/CVE-2026-77244/) — fetched 2026-09-23: the full CVE-2026-77243…-77274 block with per-CVE titles and CVSS, cross-checked against the GHSA pages.
- [sooperset/mcp-atlassian — releases](https://github.com/sooperset/mcp-atlassian/releases) and PyPI `time` field, fetched 2026-09-23: 0.22.0 (2026-07-10), 0.22.1 (07-11), 0.23.0 (07-18), 0.23.1 (08-19); current 0.23.1; PyPI recent downloads 161,122/week (`pypistats`).