CVE-2026-77244 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-77244 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-77244 is a critical authentication bypass in pip mcp-atlassian that can expose Jira and Confluence through the MCP HTTP transport. In the common “single-user” deployment pattern, the server uses operator-supplied environment credentials (JIRA_USERNAME/JIRA_API_TOKEN or Confluence equivalents). Due to a broken token verifier, missing auth challenge in the default HTTP setup, and fallback to env credentials when no user token is present, an attacker who can reach the HTTP port can make tool calls with no valid login at all and the server will act using the operator’s Atlassian identity.

This is CRITICAL (CVSS 10). It is not known to be exploited in the wild and is not in CISA KEV, but the exposure risk is immediate for any internet-reachable, LAN-reachable, or tunnel-exposed deployment.

Immediate Action

  • Take the service off the network now if it is exposed on a public IP, shared LAN, reverse proxy, ngrok/Cloudflare Tunnel, or Kubernetes ingress.
  • Rollback or disable HTTP transport until a fixed release is available; prefer local-only or Unix socket access if you must keep it running.
  • Rotate Atlassian API tokens immediately if the service was reachable by untrusted users. Treat operator credentials as potentially exposed.
  • Block access at the edge (security group, firewall, ingress, reverse proxy auth) before restarting the service.
  • Check vendor advisories and release notes for a patched version: vendor advisory / release notes.
  • Assume full read/write access to Jira and Confluence if the service was reachable without strong auth.

Affected Versions

  • mcp-atlassian@<= TODO_vulnerable_version — vulnerable when running in streamable-http mode with default auth settings.
  • mcp-atlassian@<= current main branch — vulnerable based on the described auth verifier and middleware behavior.
  • mcp-atlassian@TODO_fixed_version+ — safe only after the vendor ships a release that requires real authentication or forces single-user mode to bind locally.

TODO: Replace the placeholders above with the exact fixed release once the maintainer publishes it.

Resolution Guide

Python / pip

pip uninstall -y mcp-atlassian
pip install "mcp-atlassian==TODO_fixed_version"
# or, if you must stay on the current line:
pip install --upgrade "mcp-atlassian>=TODO_fixed_version"

pipx

pipx upgrade mcp-atlassian
# if a fixed version is known:
pipx install "mcp-atlassian==TODO_fixed_version"

JavaScript / npm / yarn / pnpm

npm install mcp-atlassian@TODO_fixed_version
# yarn add mcp-atlassian@TODO_fixed_version
# pnpm add mcp-atlassian@TODO_fixed_version

Maven / Gradle — not directly applicable unless you vendor this service into a Java wrapper. Update the underlying Python service instead.

apt / yum — no standard distro package is assumed. If you containerize it, update the image tag instead.

Docker

docker pull TODO_VENDOR_IMAGE:TODO_fixed_tag
docker stop mcp-atlassian
docker rm mcp-atlassian
docker run --rm -p 127.0.0.1:3000:3000 \
  -e MCP_TRANSPORT=streamable-http \
  -e MCP_ATLASSIAN_SINGLE_USER=true \
  TODO_VENDOR_IMAGE:TODO_fixed_tag

Hardening until patched

# Do not expose the HTTP port publicly
export MCP_TRANSPORT=streamable-http
export MCP_ATLASSIAN_SINGLE_USER=true
export MCP_ATLASSIAN_BIND_PUBLIC=false
# Prefer local-only bind or firewall-restricted access

Minimal code fix concept — the server should refuse to start HTTP transport unless auth is real or single-user mode is explicitly acknowledged:

if MCP_TRANSPORT == "streamable-http" and not auth_provider and not SINGLE_USER_MODE:
    raise SystemExit(
        "HTTP transport requires OAUTH_PROXY_ENABLE=true or MCP_ATLASSIAN_SINGLE_USER=true"
    )

Also replace the opaque “accept any non-empty token” verifier with a real Atlassian token check (for example, a /rest/api/3/myself call) and bind to 127.0.0.1 by default.

Detection & Verification

Check whether you are exposed

echo "$MCP_TRANSPORT"
env | grep -E 'JIRA_(URL|USERNAME|API_TOKEN)|CONFLUENCE_(URL|USERNAME|API_TOKEN)|OAUTH_PROXY_ENABLE|MCP_ATLASSIAN'
ss -ltnp | grep ':3000'
docker ps --format 'table {{.Names}}\t{{.Ports}}\t{{.Image}}'

Source / image inspection

grep -R "verify_token" -n src/mcp_atlassian
grep -R "OAUTH_PROXY_ENABLE_ENV\|streamable-http\|from_env()" -n src/mcp_atlassian

Quick vulnerability test — if this returns Jira/Confluence data with no valid auth, you are vulnerable:

curl -X POST http://127.0.0.1:3000/mcp \
  -H "content-type: application/json" \
  -H "accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc":"2.0","id":1,"method":"tools/call",
    "params":{"name":"jira_get_issue","arguments":{"issue_key":"PROJ-1"}}
  }'

Verify the fix

# This should now fail without proper auth
curl -i -X POST http://127.0.0.1:3000/mcp \
  -H "content-type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

# If single-user mode is enabled, confirm it is local-only
ss -ltnp | grep ':3000'
# Expect 127.0.0.1 only, not 0.0.0.0

Risk and Impact

An attacker with network reach to the MCP HTTP port can invoke Jira and Confluence tools without a real login. In the common environment-credential deployment, the server falls back to the operator’s Atlassian token, so the attacker inherits the operator’s access and audit trail.

That means full read/write access to issues, comments, attachments, pages, spaces, and potentially sensitive data stored in tickets or docs. If the service is exposed beyond localhost, treat it as a high-priority incident and rotate credentials immediately.

Keep reading