Executive brief
MCP Atlassian is a server that allows AI models to interact with Atlassian products like Jira and Confluence. Prior to version 0.22.0, an unauthenticated network attacker could send requests to the HTTP endpoint and have them processed using the operator's global credentials, allowing unauthorized operations on Jira and Confluence with full administrator permissions. This could lead to data exfiltration, account compromise, or system manipulation depending on the operator's access level.
Technical details
The vulnerability exists in the HTTP transport layer (streamable-http) where unauthenticated requests silently fall back to globally configured Jira or Confluence credentials via the UserTokenMiddleware and _get_fetcher code paths. An attacker can reach tool handlers without per-user identity validation when the deployment lacks an independent authentication boundary. Version 0.22.0 addresses this by rejecting unauthenticated requests at the transport boundary with a 401 response; global credential fallback is now opt-in via ALLOW_GLOBAL_CRED_FALLBACK (default off).
Affected products
- sooperset mcp-atlassian prior to 0.22.0
Timeline
- 2026-09-22: disclosed
- 2026-07-10: patched: Security fix merged in version 0.22.0