CVE-2026-77251: mcp-atlassian JQL/CQL filter bypass in Jira and Confluence search

CVE-2026-77251 · Severity: high · CVSS 4 · Published 2026-09-22

mcp-atlassian is a popular bridge that exposes Jira and Confluence data to AI agents (LLMs) through a standardized protocol. Operators set project and space filters to prevent AI agents—which may be controlled by untrusted prompts—from accessing restricted projects. Due to three distinct filter-bypass bugs, attackers can craft search queries that return sensitive data from forbidden projects and spaces despite these restrictions being in place. One bypass has been confirmed working against real Atlassian Cloud deployments.

Technologies: mcp-atlassian (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-77251 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77251 being exploited in the wild.
How severe is CVE-2026-77251?
High severity, with a CVSS score of 4, published 22 September 2026.
Which products and versions are affected?
mcp-atlassian (PyPI) < 0.22.0, ECOSYSTEM:introduced=0,fixed=0.22.0.
Is there a fix for CVE-2026-77251?
Yes. mcp-atlassian (PyPI): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77251 attacked?
It is attacked over the network.
Am I affected by CVE-2026-77251?
Check whether you run mcp-atlassian (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp-atlassian (PyPI): upgrade to 0.22.0 or later
    pip install "mcp-atlassian>=0.22.0"

Technical details

The vulnerability consists of three sub-bugs in filter enforcement: (A1) Jira's jira_search endpoint checks only whether the string "project = " appears in the query using a case-insensitive substring search, then appends an allowlist; an attacker can supply "project = <forbidden-key>" and bypass this check because the substring match is satisfied regardless of which project is named. (A2) Confluence's confluence_search has the same logic but with a case-sensitive substring check, allowing uppercase "SPACE = " to bypass it. (B) Agile board endpoints (get_board_issues, get_agile_boards) lack filter checks entirely. Attack vector is network (the MCP protocol accepts remote JQL/CQL queries); no authentication is required beyond the operator's PAT credentials, which the operator has already provided. An attacker controlling an LLM prompt can exfiltrate data from any project in the operator's Jira workspace. Patches are available in later versions that implement proper AST-based query parsing instead of substring checks.

Affected products

  • mcp-atlassian mcp-atlassian up to 0.21.1

Identifiers

  • CVE-2026-77251
  • GHSA-w66g-j6c4-hcfc
  • PYSEC-2026-4102

Timeline

  • 2026-09-22: disclosed: GHSA-w66g-j6c4-hcfc advisory published
  • 2026-05-18: exploited: Live bypass confirmed on production Atlassian Cloud

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.