CVE-2026-77254

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0

Description Requests to the HTTP MCP endpoint without a per-user identity can reach tool handlers that utilize globally configured Jira or Confluence credentials. This allows a network caller to perform operations using the permissions of the operator account if the deployment lacks an independent authentication boundary. The processing flow involves streamable-http, UserTokenMiddleware, get fetcher, and global credentials.

Recommendations Update to version 0.22.0.