Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-77252

MCP Atlassian: JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER can be bypassed in search tools

CVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-77252

Published

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, caller-supplied projects_filter and spaces_filter arguments can replace administrator-configured allowlists, and caller-provided project or space clauses can suppress the configured restriction. A caller can search projects or spaces outside the intended boundary when the configured Atlassian credentials can access them. The advisory traces the vulnerable input and processing flow through JIRA_PROJECTS_FILTER, CONFLUENCE_SPACES_FILTER, projects_filter, spaces_filter, SearchMixin.search_issues, and SearchMixin.search, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-77252

Published

mcp-atlassian

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "sooperset",
                    "product": "mcp-atlassian",
                    "versions": [
                        {
                            "version": "< 0.22.0",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON