CVE-2026-77251: MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira search accepts a forbidden project clause because it checks only for the presence of project syntax, Confluence search uses an incomplete case-sensitive space check, and Jira board APIs omit project-filter enforcement. These paths expose issues, boards, or pages outside JIRAPROJECTSFILTER or CONFLUENCESPACESFILTER when the operator credentials have broader access. The advisory traces the vulnerable input and processing flow through jirasearch, confluencesearch, getboardissues, getagileboards, JIRAPROJECTSFILTER, and CONFLUENCESPACESFILTER, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MCP Atlassianto a version that resolves this vulnerability.Fixed in 0.22.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running MCP Atlassian before 0.22.0 are exposed if the configured operator credentials can access Jira projects or Confluence spaces outside the intended JIRA_PROJECTS_FILTER or CONFLUENCE_SPACES_FILTER scope.
What does an attacker need to exploit it?
An attacker needs a path to invoke affected MCP operations. The affected entry points include jira_search, confluence_search, get_board_issues, and get_agile_boards, where crafted searches or board requests can retrieve content outside configured filters.
Are the configured project and space filters sufficient protection on vulnerable versions?
No. Before 0.22.0, Jira search can accept a forbidden project clause, Confluence search has an incomplete case-sensitive space check, and Jira board APIs do not enforce project filters.
What should teams do if they cannot upgrade immediately?
Restrict the operator credentials so they do not have access to projects or spaces that must remain out of scope. The filters alone are not reliable boundaries on affected versions.
How can we determine whether our deployment is affected?
Check whether MCP Atlassian is running a version earlier than 0.22.0 and whether its operator credentials have broader Jira or Confluence access than the configured filters permit. Review use of the affected search and board API entry points.