Description
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, ENABLED_TOOLS and TOOLSETS are applied when tools are listed but are not rechecked when a tools/call request is dispatched. A client that knows a hidden tool name can directly invoke excluded read, write, or delete tools despite the operator's configured least-privilege restrictions. The advisory traces the vulnerable input and processing flow through ENABLED_TOOLS, TOOLSETS, tools/list, tools/call, and _call_tool_mcp, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
Published: 2026-09-22
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Authorization bypass enabling execution of restricted tools
Action: Immediate Patch
AI Analysis

Impact

In the MCP Atlassian server, the lists ENABLED_TOOLS and TOOLSETS are applied only when tools are first enumerated but are not re‑verified when a call to a tool is made. An attacker who knows the name of a hidden tool can call that tool directly, executing read, write, or delete operations that the operator had intended to block. This flaw allows an attacker to bypass the least‑privilege policy that the operator configured, effectively granting unauthorized operations against the underlying Atlassian product data.

Affected Systems

The issue affects the sooperset:mcp-atlassian product in all releases prior to version 0.22.0. The vulnerability is fixed starting with that release. The affected environment is a Model Context Protocol server used by Atlassian Confluence and Jira.

Risk and Exploitability

The CVSS score of 8.8 classifies the vulnerability as high severity. Because the EPSS score is not available, the exact likelihood cannot be quantified, but the flaw is exploitable by any entity that can send a request to the MCP server after discovering a hidden tool name. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could exploit the flaw remotely over the network without needing privileged access to the server, making it a significant threat for deployments that expose the MCP endpoint without proper access controls.

Generated by OpenCVE AI on September 22, 2026 at 20:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to MCP Atlassian 0.22.0 or later to apply the vendor patch that re‑checks tool authorization on every call.
  • If patching is not immediately possible, restrict network access to the MCP server or firewall the tools/call endpoint so only trusted hosts can invoke tool calls.
  • Audit existing tool configurations to identify and remove any unintended hidden tools, ensuring that the configured least‑privilege policy matches operational requirements.

Generated by OpenCVE AI on September 22, 2026 at 20:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-3r68-hf9h-887v MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass
History

Tue, 22 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Sooperset
Sooperset mcp-atlassian
Vendors & Products Sooperset
Sooperset mcp-atlassian

Tue, 22 Sep 2026 18:15:00 +0000

Type Values Removed Values Added
Description MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, ENABLED_TOOLS and TOOLSETS are applied when tools are listed but are not rechecked when a tools/call request is dispatched. A client that knows a hidden tool name can directly invoke excluded read, write, or delete tools despite the operator's configured least-privilege restrictions. The advisory traces the vulnerable input and processing flow through ENABLED_TOOLS, TOOLSETS, tools/list, tools/call, and _call_tool_mcp, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
Title MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Sooperset Mcp-atlassian
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-22T19:02:45.226Z

Reserved: 2026-08-20T19:02:23.416Z

Link: CVE-2026-77243

cve-icon Vulnrichment

Updated: 2026-09-22T19:02:22.493Z

cve-icon NVD

Status : Received

Published: 2026-09-22T18:17:17.410

Modified: 2026-09-22T19:16:48.617

Link: CVE-2026-77243

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T20:15:09Z

Weaknesses