https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T21:31:36.680962+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-77251 fkie_cve-2026-77251 2026-09-29T21:31:36.683119+00:00

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira search accepts a forbidden project clause because it checks only for the presence of project syntax, Confluence search uses an incomplete case-sensitive space check, and Jira board APIs omit project-filter enforcement. These paths expose issues, boards, or pages outside JIRA_PROJECTS_FILTER or CONFLUENCE_SPACES_FILTER when the operator credentials have broader access. The advisory traces the vulnerable input and processing flow through jira_search, confluence_search, get_board_issues, get_agile_boards, JIRA_PROJECTS_FILTER, and CONFLUENCE_SPACES_FILTER, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

 https://vulnerability.circl.lu/vuln/ghsa-w66g-j6c4-hcfc GHSA-w66g-j6c4-hcfc ā€” MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-pā€¦ 2026-09-29T21:31:36.683228+00:00

Affected: PyPI: mcp-atlassian

### Summary

`mcp-atlassian` is a popular community MCP server wrapper exposing Jira / Confluence to MCP clients. Operators commonly restrict the surface to a small allowlist of projects/spaces via the `JIRA_PROJECTS_FILTER` and `CONFLUENCE_SPACES_FILTER` environment variables, which the README documents as the principal mechanism for limiting attacker-controlled MCP clients (= prompt-injected LLM agents) to the operator's intended subset of the workspace.

We identified **three distinct sub-bugs** that let attacker-controlled queries read content from **forbidden** projects/spaces (= projects NOT in the operator's filter) despite the filter being correctly set. The most severe is **empirically reproduced on production Atlassian Cloud** with real operator credentials and sentinel content in two real projects.

| Sub-bug | Layer | Class | Live? | |---|---|---|---| | **A1** | Jira `jira_search` `jql` | substring-bypass | šŸ”“ **LIVE PROVEN 2026-05-18 on real Atlassian Cloud** | | **A2** | Confluence `confluence_search` `cql` | case-sensitive substring-bypass | code-level verified | | **B** | Jira agile `get_board_issues` / `get_agile_boards` | zero-filter (missing check) | code-level verified |

### Details

**Sub-bug A1** ā€” `src/mcp_atlassian/jira/search.py` lines 92-94 at HEAD `d8bc78698a63cb6b321c7ca796d6329d448f7f6d`:

```python if projects_filter and "project = " not in jql.lower(): jql = f"{jql} AND project in ({','.join(projects_filter)})" ```

The substring check is sā€¦