CVE-2026-77251: MCP Atlassian: project/space filter bypass exposes data

Q: Is CVE-2026-77251 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-77251, increasing the risk of exploitation.

Q: How to fix CVE-2026-77251?

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Do not rely on JIRA_PROJECTS_FILTER or CONFLUENCE_SPACES_FILTER as a security boundary: issue Atlassian API tokens or OAuth scopes from a service account limited to the required projects and spaces. 3) Until patched, disable jira_search, confluence_search, get_board_issues, and get_agile_boards, or restrict the server to read-only tools for trusted users. 4) Review Atlassian audit logs and MCP server logs for queries containing project or space clauses outside the allowlist, including case variants such as lowercase space keys. 5) Inventory MCP servers across developer machines and agent platforms to find unmanaged installs.

Q: What systems are affected by CVE-2026-77251?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling agents, RAG pipelines, enterprise knowledge assistants.

Q: What is the CVSS score for CVE-2026-77251?

No CVSS score has been assigned yet.

GHSA-w66g-j6c4-hcfcHIGHPoC AVAILABLECISA: ATTEND

Published September 22, 2026

CISO Take

MCP Atlassian, the MCP server that lets AI agents search Jira and Confluence, enforces its project and space allowlists (JIRA_PROJECTS_FILTER, CONFLUENCE_SPACES_FILTER) incompletely, so an agent or user can read issues, boards, and pages the operator meant to hide. This matters because the filters are the only guardrail between a broadly privileged service account and an LLM, and they fail whenever the credentials have wider access than intended. Exploitation likelihood is low-to-moderate (EPSS 0.24%, 86th percentile), the CVE is not in CISA KEV, and CISA SSVC rates it ATTEND with a public PoC. Blast radius in the package ecosystem is small (1 downstream dependent), but the same package has 38 other CVEs, which signals weak security hygiene. Upgrade mcp-atlassian to 0.22.0 or later, and in the meantime scope the Atlassian credentials to only the projects and spaces the agent should see.

Sources:NVDEPSSGitHub AdvisoryATLASCISA SSVC

What is the risk?

High severity, medium practical risk. The flaw is an authorization and protection-mechanism failure (CWE-863, CWE-693, CWE-184): the Jira search check only looks for the presence of project syntax, the Confluence space check is case-sensitive and incomplete, and Jira board APIs skip filter enforcement entirely. Exploitation needs access to the agent's tool interface, either directly or via prompt injection, and impact is confidentiality only. Risk grows with how broad the operator's Atlassian credentials are. Public PoC availability and the SSVC ATTEND decision raise priority, while the low EPSS and absence from KEV limit urgency. No CVSS vector was published.

How does the attack unfold?

Initial Access

The attacker obtains access to the AI agent's chat interface, or plants an indirect prompt injection in content the agent reads.

AML.T0051.001

Tool Invocation

The agent is induced to call jira_search, confluence_search, get_board_issues, or get_agile_boards with inputs that slip past the project and space filter checks.

AML.T0053

Filter Bypass

The incomplete presence check, case-sensitive space check, and missing board enforcement let the query run against projects and spaces outside the allowlist using the broader operator credentials.

AML.T0036

Impact

Confidential Jira issues and Confluence pages are returned to the LLM and disclosed to the requester or exfiltrated.

AML.T0085.001

Initial Access

The attacker obtains access to the AI agent's chat interface, or plants an indirect prompt injection in content the agent reads.

AML.T0051.001

Tool Invocation

The agent is induced to call jira_search, confluence_search, get_board_issues, or get_agile_boards with inputs that slip past the project and space filter checks.

AML.T0053

Filter Bypass

The incomplete presence check, case-sensitive space check, and missing board enforcement let the query run against projects and spaces outside the allowlist using the broader operator credentials.

AML.T0036

Impact

Confidential Jira issues and Confluence pages are returned to the LLM and disclosed to the requester or exfiltrated.

AML.T0085.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MCP Atlassian	pip	< 0.22.0	`0.22.0`
2 dependents85% patched~4d to patchFull package profile →

Do you use MCP Atlassian? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 19% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Do not rely on JIRA_PROJECTS_FILTER or CONFLUENCE_SPACES_FILTER as a security boundary: issue Atlassian API tokens or OAuth scopes from a service account limited to the required projects and spaces. 3) Until patched, disable jira_search, confluence_search, get_board_issues, and get_agile_boards, or restrict the server to read-only tools for trusted users. 4) Review Atlassian audit logs and MCP server logs for queries containing project or space clauses outside the allowlist, including case variants such as lowercase space keys. 5) Inventory MCP servers across developer machines and agent platforms to find unmanaged installs.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassData ExtractionAgentPluginAPIAML.T0036- Data from Information Repositories AML.T0051.001- Indirect AML.T0053- AI Agent Tool Invocation AML.T0085.001- AI Agent Tools

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.2-Data for development and enhancement of AI system

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM02:2025-Sensitive Information DisclosureLLM06:2025-Excessive Agency

Frequently Asked Questions

What is CVE-2026-77251?

Is CVE-2026-77251 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-77251, increasing the risk of exploitation.

How to fix CVE-2026-77251?

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Do not rely on JIRA_PROJECTS_FILTER or CONFLUENCE_SPACES_FILTER as a security boundary: issue Atlassian API tokens or OAuth scopes from a service account limited to the required projects and spaces. 3) Until patched, disable jira_search, confluence_search, get_board_issues, and get_agile_boards, or restrict the server to read-only tools for trusted users. 4) Review Atlassian audit logs and MCP server logs for queries containing project or space clauses outside the allowlist, including case variants such as lowercase space keys. 5) Inventory MCP servers across developer machines and agent platforms to find unmanaged installs.

What systems are affected by CVE-2026-77251?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling agents, RAG pipelines, enterprise knowledge assistants.

What is the CVSS score for CVE-2026-77251?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP serverstool-calling agentsRAG pipelinesenterprise knowledge assistants

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0051.001Indirect

AML.T0053AI Agent Tool Invocation

AML.T0085.001AI Agent Tools

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.2

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02:2025, LLM06:2025

What are the technical details?

Original Advisory

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira search accepts a forbidden project clause because it checks only for the presence of project syntax, Confluence search uses an incomplete case-sensitive space check, and Jira board APIs omit project-filter enforcement. These paths expose issues, boards, or pages outside JIRA_PROJECTS_FILTER or CONFLUENCE_SPACES_FILTER when the operator credentials have broader access. The advisory traces the vulnerable input and processing flow through jira_search, confluence_search, get_board_issues, get_agile_boards, JIRA_PROJECTS_FILTER, and CONFLUENCE_SPACES_FILTER, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Exploitation Scenario

An internal AI assistant uses mcp-atlassian with a service account that has company-wide Jira and Confluence access, restricted only by JIRA_PROJECTS_FILTER=ENG. A user, or an attacker who plants an indirect prompt injection in a ticket comment, instructs the agent to run a JQL search containing a project clause for a restricted project such as SEC or HR, or to call get_agile_boards, or to query Confluence with a lower-case space key. The filter checks pass, and the server returns confidential issues and pages to the LLM, which then reveals them to the requester or sends them out through another tool.

Weaknesses (CWE)

CWE-1276Hardware Child Block Incorrectly Connected to Parent SystemPrimary CWE-184Incomplete List of Disallowed InputsPrimary CWE-693Protection Mechanism FailurePrimary CWE-863Incorrect AuthorizationPrimary CWE-1276Hardware Child Block Incorrectly Connected to Parent System

CWE-1276 — Hardware Child Block Incorrectly Connected to Parent System: Signals between a hardware IP and the parent system design are incorrectly connected.

[Testing] System-level verification may be used to ensure that components are correctly connected and that design security requirements are not violated due to interactions between various IP blocks.

Source: MITRE CWE corpus.