Executive brief
mcp-atlassian is a Model Context Protocol server that connects Claude and other AI assistants to Jira and Confluence. The HTTP transport layer contains an authentication bypass that allows unauthenticated attackers to access Jira and Confluence using the server's configured credentials. An attacker with network access to the exposed server can read and modify all issues, pages, attachments, and user data, all while appearing as the legitimate operator in audit logs.
Technical details
The vulnerability combines two flawed design choices: (1) AtlassianOpaqueTokenVerifier.verify_token() accepts any non-empty string as valid, always granting requested scopes without actual verification; (2) UserTokenMiddleware does not reject requests lacking an Authorization header — it simply leaves the user token empty, causing tool handlers to fall back to environment-variable credentials (JIRA_API_TOKEN, CONFLUENCE_API_TOKEN). An unauthenticated attacker reaching the HTTP transport (network-exposed, Docker port-mapped, or behind an auth-less proxy) can omit the Authorization header or send any garbage Bearer token; the request reaches tool handlers, which authenticate to Atlassian using the operator's credentials. No token validation, API verification, or network isolation by default prevents exploitation. Patch availability: fix suggested in the advisory (explicit single-user mode flag, localhost binding by default, real token verification).
Affected products
- Anthropic mcp-atlassian main branch (current at time of disclosure)
Timeline
- 2026-09-22: disclosed: GitHub Security Advisory GHSA-wrhw-j3f9-8vc6 published
- 2026-05: other: Related unauthenticated RCE vulnerability CVE-2026-27825 (Arctic Wolf) previously disclosed for similar code path