CVE-2026-77254: MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or Confluence credentials. A network caller can perform operations with the operator account's permissions unless the deployment has an independent authentication boundary. The advisory traces the vulnerable input and processing flow through streamable-http, UserTokenMiddleware, getfetcher, and global credentials, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MCP Atlassianto a version that resolves this vulnerability.Fixed in 0.22.0 - Compensating control
Deploy an independent authentication boundary for the HTTP MCP endpoint so unauthenticated network callers cannot use the operator account's globally configured Jira or Confluence credentials.
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated use of the configured Atlassian account?
Deployments running a version prior to 0.22.0 are exposed when their HTTP MCP endpoint is reachable by a network caller and no independent authentication boundary prevents unauthenticated requests from reaching it. The issue affects both Jira and Confluence operations when global credentials are configured.
What does an attacker need to exploit this issue?
An attacker needs network access to the HTTP MCP endpoint. No authentication, user identity, or user interaction is required if the endpoint lacks an independent authentication boundary.
What access could an attacker obtain through a vulnerable endpoint?
Unauthenticated requests can reach MCP tool handlers that use the globally configured Jira or Confluence credentials. An attacker can therefore perform operations with the permissions of the operator account associated with those credentials.
What should be done if upgrading cannot happen immediately?
Place an independent authentication boundary in front of the HTTP MCP endpoint so unauthenticated network callers cannot reach it. Restricting network access to trusted callers also reduces exposure.
How can an administrator determine whether an instance is affected?
An instance is affected if it runs MCP Atlassian before version 0.22.0, has globally configured Jira or Confluence credentials, and permits unauthenticated requests to reach the HTTP MCP endpoint. The relevant processing path includes streamable-http, UserTokenMiddleware, _get_fetcher, and use of global credentials.