CVE-2026-77251: MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)
mcp-atlassian is a popular community MCP server wrapper exposing Jira / Confluence to MCP clients. Operators commonly restrict the surface to a small allowlist of projects/spaces via the JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER environment variables, which the README documents as the principal mechanism for limiting attacker-controlled MCP clients (= prompt-injected LLM agents) to the operator’s intended subset of the workspace.
We identified three distinct sub-bugs that let attacker-controlled queries read content from forbidden projects/spaces (= projects NOT in the operator’s filter) despite the filter being correctly set. The most severe is empirically reproduced on production Atlassian Cloud with real operator credentials and sentinel content in two real projects.
| Sub-bug | Layer | Class | Live? |
|---|---|---|---|
| A1 | Jira jira_search jql | substring-bypass | 🔴 LIVE PROVEN 2026-05-18 on real Atlassian Cloud |
| A2 | Confluence confluence_search cql | case-sensitive substring-bypass | code-level verified |
| B | Jira agile get_board_issues / get_agile_boards | zero-filter (missing check) | code-level verified |
References
- github.com/advisories/GHSA-w66g-j6c4-hcfc
- github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460
- github.com/sooperset/mcp-atlassian/pull/1448
- github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0
- github.com/sooperset/mcp-atlassian/security/advisories/GHSA-w66g-j6c4-hcfc
- nvd.nist.gov/vuln/detail/CVE-2026-77251
Code Behaviors & Features
Detect and mitigate CVE-2026-77251 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →