Model Context Protocol Vulnerability in Atlassian Confluence and Jira
CVE-2026-77254

9.1CRITICAL

Key Information:

Vendor

Sooperset

Status
Mcp-atlassian
Vendor
CVE Published:
22 September 2026

What is CVE-2026-77254?

A security flaw exists in the Model Context Protocol (MCP) server utilized by Atlassian Confluence and Jira, allowing requests to the HTTP MCP endpoint without a per-user identity. This misconfiguration enables a network caller to execute operations using the permissions associated with the operator account, unless mitigation through independent authentication boundaries is in place. The vulnerability has been traced through various processing pathways, revealing significant control and code flow issues that have since been addressed in version 0.22.0.

Affected Version(s)

mcp-atlassian < 0.22.0

References

https://github.com/sooperset/mcp-atlassian/security/advis...
x_refsource_CONFIRM
https://github.com/sooperset/mcp-atlassian/pull/1448
x_refsource_MISC
https://github.com/sooperset/mcp-atlassian/commit/b041733...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.