CVE-2026-77252

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0

Description Caller-supplied projects filter and spaces filter arguments can override administrator-configured allowlists. Additionally, caller-provided project or space clauses can suppress configured restrictions, allowing a user to search projects or spaces outside the intended boundary if the configured Atlassian credentials have the necessary access. The issue involves the processing flow through JIRA PROJECTS FILTER, CONFLUENCE SPACES FILTER, projects filter, spaces filter, and the functions SearchMixin.search issues() and SearchMixin.search().

Recommendations Update to version 0.22.0.