CVE-2026-77243: MCP Atlassian: missing authz lets clients call hidden tools

Q: Is CVE-2026-77243 actively exploited?

No confirmed active exploitation of CVE-2026-77243 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-77243?

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Until patched, restrict network access to the MCP server and require authentication for every client. 3) Use Atlassian API tokens or OAuth scopes with minimal permissions (read-only where possible) rather than relying on ENABLED_TOOLS or TOOLSETS. 4) Audit MCP server logs for tools/call requests naming tools outside the configured allowlist. 5) Review Jira and Confluence audit logs for unexpected edits or deletions made by the service account. 6) Rotate Atlassian tokens if suspicious activity is found.

Q: What systems are affected by CVE-2026-77243?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling LLM agents, enterprise knowledge integrations.

Q: What is the CVSS score for CVE-2026-77243?

CVE-2026-77243 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.54%.

GHSA-3r68-hf9h-887vHIGHCISA: ATTEND

Published September 22, 2026

CISO Take

MCP Atlassian versions before 0.22.0 enforce the ENABLED_TOOLS and TOOLSETS restrictions only when listing tools, not when a tools/call request is dispatched. Any authenticated client that knows or guesses a hidden tool name can therefore invoke read, write, or delete Jira and Confluence tools the operator deliberately disabled, defeating least-privilege configurations. The CVSS score is 8.8 (network, low complexity, low privileges), and CISA SSVC rates it ATTEND. EPSS is low at 0.32% (top 77%), there is no public exploit or Nuclei template, and it is not in CISA KEV, so mass exploitation is unlikely today. Exposure is mainly through AI agents, since a prompt-injected or compromised agent client could call destructive tools the operator believed were blocked. Upgrade mcp-atlassian to 0.22.0 or later. The package has had 38 other CVEs, so also review how much Atlassian access the server's credentials carry.

Sources:NVDGitHub AdvisoryEPSSATLASCISA SSVC

What is the risk?

High severity (CVSS 8.8) but moderate near-term likelihood: EPSS 0.00323 (top 77%), no public exploit, no scanner template, not in KEV. Exploitation is trivial for anyone with low-privilege client access who knows tool names, which are predictable and documented in the open-source project. Impact depends on the permissions of the Atlassian API token the server uses. Organizations that relied on ENABLED_TOOLS or TOOLSETS as a read-only guardrail are the most exposed. Only 1 downstream dependent is recorded, so supply chain blast radius is limited, though the package has a history of vulnerabilities (38 other CVEs).

How does the attack unfold?

Initial Access

Attacker or compromised agent client connects to the MCP Atlassian server with low-privilege access.

AML.T0049

Tool Discovery

Attacker learns hidden tool names from public documentation or source code, since tools/list does not show them.

AML.T0084.001

Exploitation

Attacker sends a direct tools/call request for an excluded tool, which is dispatched without rechecking ENABLED_TOOLS or TOOLSETS.

AML.T0053

Impact

Confidential Jira and Confluence data is read, modified, or deleted using the server's Atlassian credentials.

AML.T0101

Initial Access

Attacker or compromised agent client connects to the MCP Atlassian server with low-privilege access.

AML.T0049

Tool Discovery

Attacker learns hidden tool names from public documentation or source code, since tools/list does not show them.

AML.T0084.001

Exploitation

Attacker sends a direct tools/call request for an excluded tool, which is dispatched without rechecking ENABLED_TOOLS or TOOLSETS.

AML.T0053

Impact

Confidential Jira and Confluence data is read, modified, or deleted using the server's Atlassian credentials.

AML.T0101

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MCP Atlassian	pip	< 0.22.0	`0.22.0`
2 dependents85% patched~4d to patchFull package profile →

Do you use MCP Atlassian? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 46% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Until patched, restrict network access to the MCP server and require authentication for every client. 3) Use Atlassian API tokens or OAuth scopes with minimal permissions (read-only where possible) rather than relying on ENABLED_TOOLS or TOOLSETS. 4) Audit MCP server logs for tools/call requests naming tools outside the configured allowlist. 5) Review Jira and Confluence audit logs for unexpected edits or deletions made by the service account. 6) Rotate Atlassian tokens if suspicious activity is found.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageAgentPluginAPIAML.T0053- AI Agent Tool Invocation AML.T0084.001- Tool Definitions AML.T0085.001- AI Agent Tools AML.T0101- Data Destruction via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.9.2-Processes for responsible use of AI systems

NIST AI RMF

MANAGE 2.3-Responding to unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-77243?

Is CVE-2026-77243 actively exploited?

No confirmed active exploitation of CVE-2026-77243 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-77243?

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Until patched, restrict network access to the MCP server and require authentication for every client. 3) Use Atlassian API tokens or OAuth scopes with minimal permissions (read-only where possible) rather than relying on ENABLED_TOOLS or TOOLSETS. 4) Audit MCP server logs for tools/call requests naming tools outside the configured allowlist. 5) Review Jira and Confluence audit logs for unexpected edits or deletions made by the service account. 6) Rotate Atlassian tokens if suspicious activity is found.

What systems are affected by CVE-2026-77243?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling LLM agents, enterprise knowledge integrations.

What is the CVSS score for CVE-2026-77243?

CVE-2026-77243 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.54%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP serverstool-calling LLM agentsenterprise knowledge integrations

MITRE ATLAS Techniques

AML.T0053AI Agent Tool Invocation

AML.T0084.001Tool Definitions

AML.T0085.001AI Agent Tools

AML.T0101Data Destruction via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.9.2

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, ENABLED_TOOLS and TOOLSETS are applied when tools are listed but are not rechecked when a tools/call request is dispatched. A client that knows a hidden tool name can directly invoke excluded read, write, or delete tools despite the operator's configured least-privilege restrictions. The advisory traces the vulnerable input and processing flow through ENABLED_TOOLS, TOOLSETS, tools/list, tools/call, and _call_tool_mcp, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Exploitation Scenario

An organization deploys mcp-atlassian for an internal AI assistant and sets ENABLED_TOOLS to read-only search and fetch tools, excluding delete and write tools. An attacker with low-privilege access to the MCP endpoint, or a malicious instruction embedded in a Jira ticket that hijacks the agent, sends a direct tools/call request for a hidden tool such as a delete-issue or update-page tool. Because the server does not recheck the allowlist at dispatch, the call runs with the service account's full Atlassian permissions. The attacker can then exfiltrate confidential project data, alter documentation, or delete content.

Weaknesses (CWE)

CWE-862Missing AuthorizationPrimary CWE-862Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.