CVE-2026-77244: MCP Atlassian: unauthenticated access to operator Jira/Confluence

Q: Is CVE-2026-77244 actively exploited?

No confirmed active exploitation of CVE-2026-77244 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-77244?

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Inventory all instances running with HTTP/streamable-http transport and check which interfaces and ports they listen on. 3) Until patched, bind to 127.0.0.1, use stdio transport, or place the endpoint behind an authenticating reverse proxy or private network segment with firewall allow-lists. 4) Rotate the Atlassian API tokens or OAuth credentials configured globally on the server and prefer least-privilege service accounts, read-only where possible. 5) Review Jira and Confluence audit logs for actions by the service account from unexpected times, tickets or pages, and review MCP server access logs for requests lacking an Authorization header. 6) Prefer per-user token delegation over a shared global credential.

Q: What systems are affected by CVE-2026-77244?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, MCP servers, Tool-calling AI assistants, Enterprise knowledge integrations (Jira/Confluence).

Q: What is the CVSS score for CVE-2026-77244?

CVE-2026-77244 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 0.35%.

GHSA-wrhw-j3f9-8vc6CRITICALCISA: TRACK*

Published September 22, 2026

CISO Take

MCP Atlassian before 0.22.0 lets any network client that can reach its HTTP endpoint call Atlassian tools without proving who they are, and the server silently falls back to the operator's globally configured Jira or Confluence credentials. That makes this a CVSS 10.0 unauthenticated read/write compromise of your Atlassian tenant, with scope change because the attacker acts with the service account's full rights. Exploitation likelihood is currently modest (EPSS 0.29%, top 81th percentile; not in CISA KEV; no public exploit or Nuclei template; SSVC Track*), and the package has only one tracked downstream dependent, but the attack needs nothing more than network reach to the MCP port, so exposed or flat-network deployments should be treated as urgent. Upgrade to mcp-atlassian 0.22.0 now, and until then restrict the endpoint to localhost or authenticated gateways and rotate the Atlassian tokens the server uses if it was ever reachable beyond trusted hosts.

Sources:NVDGitHub AdvisoryEPSSATLAS

What is the risk?

Critical. The flaw is network-reachable, low complexity, needs no privileges or user interaction, and has changed scope: the attacker inherits whatever the operator's Jira/Confluence account can do, including writes. Real-world risk depends on exposure: stdio or localhost-only deployments are largely unaffected, while HTTP/streamable-http deployments bound to 0.0.0.0, shared dev networks, containers or cloud hosts are directly exposed. Exploitation is trivial once the endpoint is found, though no public exploit or active exploitation is reported and EPSS is low. Package has had 38 other CVEs, which signals a weak security track record. Note that ticket and wiki content frequently contains secrets, architecture details and customer data.

How does the attack unfold?

Discovery

Attacker locates a reachable MCP Atlassian HTTP endpoint through network scanning or exposed service listings.

AML.T0006

Unauthenticated Access

Requests without a verified identity are accepted and the fetcher falls back to the operator's global Jira/Confluence credentials.

AML.T0049

Tool Invocation

Attacker calls read and write Atlassian tools directly as the operator account.

AML.T0053

Impact

Sensitive tickets and wiki content are exfiltrated and records are tampered with or seeded with malicious instructions.

AML.T0085.001

Discovery

Attacker locates a reachable MCP Atlassian HTTP endpoint through network scanning or exposed service listings.

AML.T0006

Unauthenticated Access

Requests without a verified identity are accepted and the fetcher falls back to the operator's global Jira/Confluence credentials.

AML.T0049

Tool Invocation

Attacker calls read and write Atlassian tools directly as the operator account.

AML.T0053

Impact

Sensitive tickets and wiki content are exfiltrated and records are tampered with or seeded with malicious instructions.

AML.T0085.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MCP Atlassian	pip	< 0.22.0	`0.22.0`
2 dependents85% patched~4d to patchFull package profile →

Do you use MCP Atlassian? You're affected.

How severe is it?

CVSS 3.1

10.0 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SChanged

CHigh

IHigh

ANone

What should I do?

1 step

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Inventory all instances running with HTTP/streamable-http transport and check which interfaces and ports they listen on. 3) Until patched, bind to 127.0.0.1, use stdio transport, or place the endpoint behind an authenticating reverse proxy or private network segment with firewall allow-lists. 4) Rotate the Atlassian API tokens or OAuth credentials configured globally on the server and prefer least-privilege service accounts, read-only where possible. 5) Review Jira and Confluence audit logs for actions by the service account from unexpected times, tickets or pages, and review MCP server access logs for requests lacking an Authorization header. 6) Prefer per-user token delegation over a shared global credential.

What does CISA's SSVC say?

DecisionTrack*

Exploitationnone

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData ExtractionAgentPluginAPIAML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0085.001- AI Agent Tools AML.T0086- Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.9.3-Responsible use of AI systems / access and security controls

NIST AI RMF

GOVERN 6.1-Third-party AI risk policiesMANAGE 2.3-Responses to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-77244?

Is CVE-2026-77244 actively exploited?

No confirmed active exploitation of CVE-2026-77244 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-77244?

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Inventory all instances running with HTTP/streamable-http transport and check which interfaces and ports they listen on. 3) Until patched, bind to 127.0.0.1, use stdio transport, or place the endpoint behind an authenticating reverse proxy or private network segment with firewall allow-lists. 4) Rotate the Atlassian API tokens or OAuth credentials configured globally on the server and prefer least-privilege service accounts, read-only where possible. 5) Review Jira and Confluence audit logs for actions by the service account from unexpected times, tickets or pages, and review MCP server access logs for requests lacking an Authorization header. 6) Prefer per-user token delegation over a shared global credential.

What systems are affected by CVE-2026-77244?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, MCP servers, Tool-calling AI assistants, Enterprise knowledge integrations (Jira/Confluence).

What is the CVSS score for CVE-2026-77244?

CVE-2026-77244 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 0.35%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksMCP serversTool-calling AI assistantsEnterprise knowledge integrations (Jira/Confluence)

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0085.001AI Agent Tools

AML.T0086Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.9.3

NIST AI RMF: GOVERN 6.1, MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher construction falls back to the operator's globally configured Jira or Confluence credentials. A network client that can reach the MCP endpoint can invoke Atlassian tools as the operator, including read and write operations available to that account. The advisory traces the vulnerable input and processing flow through UserTokenMiddleware, AtlassianOpaqueTokenVerifier, _get_fetcher, and streamable-http, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Exploitation Scenario

An attacker on the corporate network, or on the internet if the MCP port is exposed, scans for the MCP streamable-http endpoint of an internal Jira assistant. They send a tools/list request with no credentials, and the server accepts it and builds its fetcher from the operator's global Jira/Confluence token. The attacker calls search and get-page tools to dump confidential incident tickets, credentials pasted into pages and architecture docs, then uses write tools to alter tickets, add comments containing prompt injections targeting other agents, or modify pages to stage further compromise, all logged as the legitimate service account.

Weaknesses (CWE)

CWE-287Improper AuthenticationPrimary CWE-303Incorrect Implementation of Authentication AlgorithmPrimary CWE-862Missing AuthorizationPrimary CWE-287Improper Authentication CWE-303Incorrect Implementation of Authentication Algorithm CWE-862Missing Authorization

CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.