Description
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher construction falls back to the operator's globally configured Jira or Confluence credentials. A network client that can reach the MCP endpoint can invoke Atlassian tools as the operator, including read and write operations available to that account. The advisory traces the vulnerable input and processing flow through UserTokenMiddleware, AtlassianOpaqueTokenVerifier, _get_fetcher, and streamable-http, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
Published: 2026-09-22
Score: 10 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Authentication Bypass – Unauthorized Access
Action: Patch Now
AI Analysis

Impact

The MCP Atlassian server allows any non‑empty bearer token to be accepted by AtlassianOpaqueTokenVerifier, effectively bypassing authentication. An attacker who can reach the HTTP endpoint can impersonate the application operator, causing downstream fetcher construction to use the operator’s globally configured Jira or Confluence credentials. This enables unauthorized read and write operations against Atlassian products, leading to full control of the operator’s accounts.

Affected Systems

sooperset:mcp-atlassian releases prior to version 0.22.0 are affected. The vulnerability was fixed in release 0.22.0, which restricts token acceptance to valid, verified identities.

Risk and Exploitability

With a CVSS score of 10, the vulnerability is considered critical. No EPSS information is available, and it is not listed in the CISA KEV catalog. The attack vector is remote over the network to the MCP HTTP endpoint; no local privileges or credentials are required. An attacker who can reach the service can deploy any non‑empty token to gain operator‑level access, making exploitation highly likely if the service is exposed.

Generated by OpenCVE AI on September 22, 2026 at 19:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to mcp-atlassian 0.22.0 or later
  • Deploy network controls to restrict unauthenticated access to the MCP HTTP endpoint, such as firewall rules or reverse‑proxy authentication
  • Re‑configure or remove the operator’s globally configured Jira or Confluence credentials until the issue is resolved to limit fall‑back

Generated by OpenCVE AI on September 22, 2026 at 19:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-wrhw-j3f9-8vc6 [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token
History

Tue, 29 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Mcp-atlassian
Mcp-atlassian mcp Atlassian
CPEs cpe:2.3:a:mcp-atlassian:mcp_atlassian:*:*:*:*:*:*:*:*
Vendors & Products Mcp-atlassian
Mcp-atlassian mcp Atlassian

Wed, 23 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Sooperset
Sooperset mcp-atlassian
Vendors & Products Sooperset
Sooperset mcp-atlassian

Tue, 22 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Description MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher construction falls back to the operator's globally configured Jira or Confluence credentials. A network client that can reach the MCP endpoint can invoke Atlassian tools as the operator, including read and write operations available to that account. The advisory traces the vulnerable input and processing flow through UserTokenMiddleware, AtlassianOpaqueTokenVerifier, _get_fetcher, and streamable-http, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
Title [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token
Weaknesses CWE-287
CWE-303
CWE-862
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Mcp-atlassian Mcp Atlassian
Sooperset Mcp-atlassian
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-23T14:38:20.138Z

Reserved: 2026-08-20T19:02:23.416Z

Link: CVE-2026-77244

cve-icon Vulnrichment

Updated: 2026-09-22T18:58:29.144Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-22T18:17:17.560

Modified: 2026-09-29T15:17:49.490

Link: CVE-2026-77244

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T22:30:05Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-303

    Incorrect Implementation of Authentication Algorithm

  • CWE-862

    Missing Authorization