CVE-2026-77254: MCP Atlassian: missing auth exposes Jira/Confluence

CRITICALPoC AVAILABLECISA: ATTEND

Published September 22, 2026

CISO Take

MCP Atlassian before 0.22.0 lets any network caller reach the HTTP MCP endpoint without a per-user identity, and the tool handlers then act with the operator's global Jira or Confluence credentials (CWE-306, CVSS 9.1). This is an unauthenticated, low-complexity network attack that exposes confidential and writable Atlassian data, which often holds incident records, architecture documents and secrets pasted into tickets. Exploitation likelihood is modest on paper (EPSS 0.0062, around the 52nd percentile) and it is not in CISA KEV, but public PoC code exists and CISA SSVC rates it ATTEND, so treat it as a priority. The package has only one tracked downstream dependent but 38 other CVEs, which points to a recurring security debt in this project. Upgrade to 0.22.0 now, and until then do not expose streamable-http transport beyond localhost or a trusted network; put an authenticated reverse proxy or mTLS in front, and rotate the Atlassian tokens the server uses if it was reachable.

Sources:NVDEPSSGitHub AdvisoryATLASCISA SSVC

What is the risk?

High to critical for any deployment using streamable-http transport that is reachable over a network without an independent authentication boundary. The attack needs no privileges, no user interaction and has low complexity (AV:N/AC:L/PR:N/UI:N), giving high confidentiality and integrity impact (C:H/I:H) and no availability impact. Blast radius equals the permissions of the operator's service account, which is frequently broad. Exposure is lower where the server runs over stdio or sits only behind an authenticating gateway. Real-world exploitation is not confirmed (not in KEV, low EPSS), but a public PoC lowers the barrier.

How does the attack unfold?

Discovery

Attacker locates a network-reachable MCP Atlassian streamable-http endpoint.

AML.T0006

Initial Access

Attacker sends MCP requests without any user identity and the server accepts them.

AML.T0049

Tool Invocation

Handlers fall back to global Jira and Confluence credentials to execute the attacker's tool calls.

AML.T0053

Impact

Attacker reads sensitive tickets and pages and alters content using the operator account's permissions.

AML.T0085.001

Discovery

Attacker locates a network-reachable MCP Atlassian streamable-http endpoint.

AML.T0006

Initial Access

Attacker sends MCP requests without any user identity and the server accepts them.

AML.T0049

Tool Invocation

Handlers fall back to global Jira and Confluence credentials to execute the attacker's tool calls.

AML.T0053

Impact

Attacker reads sensitive tickets and pages and alters content using the operator account's permissions.

AML.T0085.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MCP Atlassian	pip	—	No patch
2 dependents83% patched~4d to patchFull package profile →

Do you use MCP Atlassian? You're affected.

How severe is it?

CVSS 3.1

9.1 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 50% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

ANone

What should I do?

1 step

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Until patched, run with stdio transport or bind streamable-http to 127.0.0.1 only, and place an authenticating reverse proxy, VPN or mTLS in front of any network-exposed instance. 3) Use least-privilege, read-only Atlassian service accounts or API tokens for the operator identity, and rotate tokens on any instance that was network-reachable. 4) Inventory MCP servers with network scans for open MCP HTTP endpoints, and review Jira and Confluence audit logs for unexpected activity from the service account, especially bulk reads, issue edits and page changes from unfamiliar times. 5) Review reverse proxy and server access logs for requests to the MCP endpoint lacking Authorization headers.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageAgentPluginAPIAML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0085.001- AI Agent Tools AML.T0101- Data Destruction via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown or unanticipated risks

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-77254?

Is CVE-2026-77254 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-77254, increasing the risk of exploitation.

How to fix CVE-2026-77254?

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Until patched, run with stdio transport or bind streamable-http to 127.0.0.1 only, and place an authenticating reverse proxy, VPN or mTLS in front of any network-exposed instance. 3) Use least-privilege, read-only Atlassian service accounts or API tokens for the operator identity, and rotate tokens on any instance that was network-reachable. 4) Inventory MCP servers with network scans for open MCP HTTP endpoints, and review Jira and Confluence audit logs for unexpected activity from the service account, especially bulk reads, issue edits and page changes from unfamiliar times. 5) Review reverse proxy and server access logs for requests to the MCP endpoint lacking Authorization headers.

What systems are affected by CVE-2026-77254?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling agents, enterprise knowledge integrations, AI coding assistants.

What is the CVSS score for CVE-2026-77254?

CVE-2026-77254 has a CVSS v3.1 base score of 9.1 (CRITICAL). The EPSS exploitation probability is 0.62%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP serverstool-calling agentsenterprise knowledge integrationsAI coding assistants

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0085.001AI Agent Tools

AML.T0101Data Destruction via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or Confluence credentials. A network caller can perform operations with the operator account's permissions unless the deployment has an independent authentication boundary. The advisory traces the vulnerable input and processing flow through streamable-http, UserTokenMiddleware, _get_fetcher, and global credentials, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Exploitation Scenario

An attacker scans internal or internet-facing ranges for an MCP Atlassian server running streamable-http. They send MCP tool-call requests with no user token. Because the server falls back to the globally configured Jira and Confluence credentials, the attacker lists projects, searches Confluence for credentials, runbooks and architecture documents, and reads security tickets. They then modify issues or pages, for example inserting malicious instructions or links into documents that other AI agents or staff will later consume, or altering ticket status to hide activity. All actions are attributed to the service account.

Weaknesses (CWE)

CWE-306Missing Authentication for Critical Functionality

CWE-306 — Missing Authentication for Critical Functionality: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.