PT-2026-96946

CVE-2026-77254

Published

2026-09-22

Updated

2026-09-22

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0

Description Requests to the HTTP MCP endpoint without a per-user identity can reach tool handlers that utilize globally configured Jira or Confluence credentials. This allows a network caller to perform operations using the permissions of the operator account if the deployment lacks an independent authentication boundary. The processing flow involves streamable-http, UserTokenMiddleware, get fetcher, and global credentials.

Recommendations Update to version 0.22.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Sondt99

Thai Son Dinh

Vendors

Affected products

Weakness enumeration

CWE-306: Missing Authentication for Critical Function