MCP Model Context Protocol Vulnerability in Atlassian Products

CVE-2026-77251

What is CVE-2026-77251?

The MCP Atlassian server, which integrates with products like Confluence and Jira, has a vulnerability due to improper project and space filter checks. Specifically, the Jira search function improperly allows forbidden project clauses, while the Confluence search lacks a complete case-sensitive space validation. Additionally, the Jira board APIs neglect to enforce necessary project filters. This oversight permits the exposure of sensitive issues, boards, or pages that should remain restricted. The vulnerability stems from several code paths and entry points, including jira_search and confluence_search, making it critical for users to upgrade to version 0.22.0 or later to mitigate these risks.

References