Quantum Secular Labs / Blog / Advisories

CVE-2026-77244: Mcp Atlassian: Improper Authentication

CVE-2026-77244 is rated critical with a CVSS v3.1 base score of 10.0 and affects Mcp Atlassian. Per its scoring, it can be exploited over the network, without authentication, without any user interaction.

Vulnerability description

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher construction falls back to the operator's globally configured Jira or Confluence credentials. A network client that can reach the MCP endpoint can invoke Atlassian tools as the operator, including read and write operations available to that account. The advisory traces the vulnerable input and processing flow through UserTokenMiddleware, AtlassianOpaqueTokenVerifier, _get_fetcher, and streamable-http, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Severity breakdown

CVSS v3.1 10.0: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Changed. Impact reaches beyond the vulnerable component to other resources.
  • Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: None. No effect on availability.

Underlying weakness

CWE-287: Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CWE-303: Incorrect Implementation of Authentication Algorithm

The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

CWE-862: Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Affected products

  • Mcp Atlassian: before 0.22.0

References