CVE-2026-77244: mcp-atlassian authentication bypass in HTTP transport

CVE-2026-77244 · Severity: critical · CVSS 10 · Published 2026-09-22

mcp-atlassian is a Model Context Protocol server that connects Claude and other AI assistants to Jira and Confluence. The HTTP transport layer contains an authentication bypass that allows unauthenticated attackers to access Jira and Confluence using the server's configured credentials. An attacker with network access to the exposed server can read and modify all issues, pages, attachments, and user data, all while appearing as the legitimate operator in audit logs.

Technologies: mcp-atlassian (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-77244 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77244 being exploited in the wild.
How severe is CVE-2026-77244?
Critical severity, with a CVSS score of 10, published 22 September 2026.
Which products and versions are affected?
mcp-atlassian (PyPI) < 0.22.0, ECOSYSTEM:introduced=0,fixed=0.22.0.
Is there a fix for CVE-2026-77244?
Yes. mcp-atlassian (PyPI): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77244 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-77244?
Check whether you run mcp-atlassian (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp-atlassian (PyPI): upgrade to 0.22.0 or later
    pip install "mcp-atlassian>=0.22.0"

Technical details

The vulnerability combines two flawed design choices: (1) AtlassianOpaqueTokenVerifier.verify_token() accepts any non-empty string as valid, always granting requested scopes without actual verification; (2) UserTokenMiddleware does not reject requests lacking an Authorization header — it simply leaves the user token empty, causing tool handlers to fall back to environment-variable credentials (JIRA_API_TOKEN, CONFLUENCE_API_TOKEN). An unauthenticated attacker reaching the HTTP transport (network-exposed, Docker port-mapped, or behind an auth-less proxy) can omit the Authorization header or send any garbage Bearer token; the request reaches tool handlers, which authenticate to Atlassian using the operator's credentials. No token validation, API verification, or network isolation by default prevents exploitation. Patch availability: fix suggested in the advisory (explicit single-user mode flag, localhost binding by default, real token verification).

Affected products

  • Anthropic mcp-atlassian main branch (current at time of disclosure)

Identifiers

  • CVE-2026-77244
  • GHSA-wrhw-j3f9-8vc6
  • PYSEC-2026-4103

Timeline

  • 2026-09-22: disclosed: GitHub Security Advisory GHSA-wrhw-j3f9-8vc6 published
  • 2026-05: other: Related unauthenticated RCE vulnerability CVE-2026-27825 (Arctic Wolf) previously disclosed for similar code path

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.