Build1 publisher2 min readPublished
MCP Atlassian hands unidentified HTTP callers the operator's Jira and Confluence access
MCP Atlassian releases before 0.22.0 fall back to the operator's credentials whenever an HTTP caller has no verified identity (CVE-2026-77244). HTTP deployments need the upgrade, and the endpoint should be reachable only through a management network or an authenticating proxy.
The Engineer · Build desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- The operator fallback is the shipped default, so an HTTP deployment that never configured authentication on its endpoint is exposed without any other mistake.
- On the Atlassian side the calls look normal: well formed, aimed at the server's published tools, and logged under the operator's legitimate account.
- Version 0.22.0 also closes CVE-2026-73496, scored 7.7, in which the attachment upload tool accepted a file path outside its intended directory.
- A similar flaw in LiteLLM, CVE-2026-59822, let an arbitrary bearer token open an authenticated MCP session and reached the Known Exploited Vulnerabilities catalog earlier in 2026.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- exposure Whoever reaches the socket gets everything the operator credential can reach, including projects, spaces and administrative endpoints the tool list never mentions.
- constraint Upgrading stops new abuse only; finding earlier misuse means searching one account's Jira and Confluence history for actions the operator did not take.
- precedent Reviews of any MCP server have to assume the HTTP caller is not the operator and validate every tool parameter that becomes a path, URL or network destination.
The fault is in the order of a fallback. The server holds credentials for Jira and Confluence so its tools can act on both [1]. Every call into those clients needs a principal. When the HTTP transport has no verified identity, the code supplies the one principal it always has available: the operator the server was configured with [7]. Refusing the call was the other option, and the code did not take it [2].
The transport decides how much that matters. With stdio, the assistant launches the process on the local machine, and the server has a parent process and a user context it can trust [4]. With HTTP, the server waits on a socket, and any party able to reach that socket counts as a client [4]. Access control on the MCP endpoint was the only control meant to stand between such a client and the operator's account. The default deployment left it optional [9].
According to the dev.to write-up that documents the flaw, every release before 0.22.0 is affected [5]. The write-up does not describe how 0.22.0 handles an unidentified caller, and it does not score CVE-2026-77244, though it gives scores for most of the other flaws it cites [19]. I would not treat an HTTP deployment as fixed until the 0.22.0 changelog or diff shows that unidentified calls are refused.
The write-up puts the bug in a run of MCP and tool-endpoint flaws reported through September 2026 in which the default configuration was the vulnerability [13]. It lists six besides this one [20]. In CVE-2026-61560, a file_path parameter could read /proc/self/environ [13]. In CVE-2026-53957, rated 7.7, host and proxy settings were tool parameters the model was free to set [16]. CVE-2026-54549, scored 8.3, passed an attacker-controlled image URL to an HTTP client that followed redirects without checking scheme, host or resolved address [15]. Two more, scored 8.4 and 6.9, got past path filters: one through case variants of .git and .obsidian on case-insensitive filesystems, one through a nested .git segment that a root-anchored deny list missed [14]. In CVE-2026-58201, rated 8.7, a path under the user's control was appended to an Azure Resource Manager base URL. That join changed how the authority was parsed, and a bearer token went to a host the operator never chose [17].
What to watch
- A CVSS score or formal advisory for CVE-2026-77244, since scanners and patch queues rank by it.
- Whether CVE-2026-77244 follows LiteLLM's CVE-2026-59822 into the Known Exploited Vulnerabilities catalog.
- Reports of Jira or Confluence activity under operator accounts traced back to exposed pre-0.22.0 endpoints.