CVE-2026-77252

Description

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, caller-supplied projects_filter and spaces_filter arguments can replace administrator-configured allowlists, and caller-provided project or space clauses can suppress the configured restriction. A caller can search projects or spaces outside the intended boundary when the configured Atlassian credentials can access them. The advisory traces the vulnerable input and processing flow through JIRA_PROJECTS_FILTER, CONFLUENCE_SPACES_FILTER, projects_filter, spaces_filter, SearchMixin.search_issues, and SearchMixin.search, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Traduire en français

Produits concernés

• sooperset mcp-atlassian
• Mcp-atlassian mcp atlassian

Scores CVSS

Faiblesses (CWE)

• CWE-284

Références

• https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460 Patch
• https://github.com/sooperset/mcp-atlassian/pull/1448 Patch
• https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0 Release Notes
• https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-rqwg-9346-fjjv ExploitVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories