Executive brief
mcp-atlassian is an open-source Model Context Protocol server that bridges AI tools to Atlassian products (Jira, Confluence). It enforces tool access controls via configuration filters (`ENABLED_TOOLS`, `TOOLSETS`) to restrict which operations are available. The bypass allows any HTTP client to invoke restricted tools—including write and delete operations on Jira issues and Confluence pages—by calling the tools directly, completely circumventing the intended access controls.
Technical details
The vulnerability is an authorization bypass in the tool dispatch layer. The `AtlassianMCP` class overrides `_list_tools_mcp` to filter tools at list time based on `ENABLED_TOOLS` and `TOOLSETS` configuration, but does not override `_call_tool_mcp`. The default FastMCP handler resolves tool calls against the full unfiltered tool registry (73 tools), bypassing filters entirely. Any authenticated or network-reachable HTTP client can invoke any tool by name via a direct JSON-RPC `tools/call` request, as tool names are public (discoverable in source code). The attack works in multi-user HTTP deployments where tool filters are trust boundaries; single-user stdio deployments are unaffected. The developers correctly implemented dual enforcement (list + call time) for `READ_ONLY_MODE`, confirming this is an implementation oversight.
Affected products
- Atlassian mcp-atlassian prior to fix
Timeline
- 2026-09-22: disclosed: GHSA-3r68-hf9h-887v published