Authorization Bypass in MCP Server for Atlassian Confluence and Jira

CVE-2026-77246

What is CVE-2026-77246?

The MCP Atlassian server, utilized for handling requests in Atlassian products like Confluence and Jira, has a critical vulnerability that allows unauthorized access under certain configurations. When the server operates with READ_ONLY_MODE set to false, it improperly accepts requests lacking Authorization identities while allowing attacker-controlled service headers. This oversight gives potential attackers the opportunity to select public hostnames for file uploads and invoke specific attachment functions, leading to unauthorized file transmission to designated endpoints. This issue has been addressed and resolved in version 0.22.0.

References