Atlassian MCP: 25 Coordinated Vulnerabilities Expose Jira, Confluence Integrations
A batch of 25 vulnerabilities in Atlassian's MCP server, affecting Jira and Confluence, were disclosed together, with critical flaws enabling SSRF and arbitrary file access.
Key findings
- 25 vulnerabilities in Atlassian MCP disclosed on Sept 22, 2026, all fixed in v0.22.0.
- Critical SSRF (CVE-2026-77254) and high-severity file access flaws dominate the batch.
- Insecure path handling in uploads allows arbitrary file read/write.
- Authentication bypasses and token exposure risks present in multiple CVEs.
- XSS and insecure URL validation also addressed in the coordinated disclosure.
- Users urged to update immediately to version 0.22.0.
On September 22, 2026, a batch of 25 vulnerabilities was disclosed for Atlassian's MCP Atlassian, a Model Context Protocol (MCP) server used with Confluence and Jira. The vulnerabilities, all affecting versions prior to 0.22.0, were disclosed within a one-hour window, indicating a coordinated disclosure event. These flaws primarily revolve around insecure handling of file paths, authentication, and URL validation, with several critical and high-severity issues allowing for potential remote code execution, sensitive file access, and server-side request forgery (SSRF).
A significant theme across many of these CVEs is the improper handling of file paths in attachment upload functionalities. Multiple vulnerabilities, including CVE-2026-77269, CVE-2026-77266, CVE-2026-77262, CVE-2026-77259, CVE-2026-77257, CVE-2026-77270, CVE-2026-77260, and CVE-2026-77258, allow an attacker to provide an absolute or traversal file path, enabling them to read arbitrary server-local files or upload sensitive files outside the intended workspace. CVE-2026-77262 and CVE-2026-77259 are particularly concerning, with CVSS scores of 8.6 and 7.7 respectively, due to their potential to expose sensitive information.
Another critical area of concern is server-side request forgery (SSRF) and insecure URL handling. CVE-2026-77254, a critical vulnerability with a CVSS score of 9.1, allows a network caller to perform operations using globally configured credentials by exploiting requests to the HTTP MCP endpoint without proper per-user identity. Similarly, CVE-2026-77246, CVE-2026-77274, CVE-2026-77271, CVE-2026-77261, CVE-2026-77267, and CVE-2026-77265 highlight issues with URL validation and header processing, which could lead to SSRF attacks, DNS rebinding, or unauthorized access to resources. CVE-2026-77261, for instance, omits SSRF protection in certain fetcher sessions, potentially allowing attackers to leverage compromised Atlassian instances.
Several vulnerabilities also impact authentication and authorization mechanisms. CVE-2026-77256 and CVE-2026-77250 describe how plaintext OAuth fallback files containing sensitive tokens are created with insecure permissions, allowing local users to read them. CVE-2026-77248 and CVE-2026-77246 indicate that unauthenticated network callers can exploit fallback to operator credentials or attacker-controlled headers to gain unauthorized access. Furthermore, CVE-2026-77253 points to bypasses in project and space allowlists, and CVE-2026-77251 details flaws in search functionalities that could be exploited for unauthorized data access.
The batch also includes a Cross-Site Scripting (XSS) vulnerability, CVE-2026-77272, where an OAuth error parameter is interpolated into an HTML page without proper escaping, allowing for injection of markup or script. Another medium-severity issue, CVE-2026-77249, involves insecure use of the requests.get function, which could be redirected by a caller-controlled public Jira URL.
All 25 vulnerabilities affect MCP Atlassian versions prior to 0.22.0. The fix for these issues is available in version 0.22.0. Users of Atlassian products integrating with MCP Atlassian are strongly advised to update to the latest version to mitigate these critical security risks. The clustered disclosure of these numerous vulnerabilities underscores the importance of prompt patching and security reviews for integrated Atlassian components.
The sheer volume and severity of these vulnerabilities, disclosed simultaneously, highlight a critical security posture for MCP Atlassian prior to version 0.22.0. The common themes of insecure file handling, authentication bypasses, and SSRF risks suggest systemic weaknesses that required a comprehensive update. Users should prioritize updating to version 0.22.0 to address these widespread security concerns and protect their Confluence and Jira instances from potential compromise.
Key findings from this disclosure include:
- A critical SSRF vulnerability (CVE-2026-77254) allowed unauthenticated operations using global credentials.
- Multiple high-severity flaws enable arbitrary file read/write via insecure attachment upload paths.
- Insecure handling of OAuth tokens and authentication headers led to unauthorized access risks.
- Flaws in URL validation and SSRF protection mechanisms were prevalent across several CVEs.
- All disclosed vulnerabilities are fixed in MCP Atlassian version 0.22.0.
- Medium severity XSS and insecure HTTP request handling were also part of the batch.
CVE IDs: ["CVE-2026-77272", "CVE-2026-77269", "CVE-2026-77268", "CVE-2026-77266", "CVE-2026-77262", "CVE-2026-77259", "CVE-2026-77257", "CVE-2026-77256", "CVE-2026-77254", "CVE-2026-77253", "CVE-2026-77249", "CVE-2026-77248", "CVE-2026-77247", "CVE-2026-77246", "CVE-2026-77274", "CVE-2026-77271", "CVE-2026-77270", "CVE-2026-77267", "CVE-2026-77265", "CVE-2026-77261", "CVE-2026-77260", "CVE-2026-77258", "CVE-2026-77252", "CVE-2026-77251", "CVE-2026-77250"] image_prompt: "A stylized representation of a server rack with multiple ports labeled 'Jira' and 'Confluence'. One port is visibly cracked, leaking abstract data streams, while another port is being bypassed by a digital serpent. The overall color palette is dark with urgent red and yellow warning lights." key_findings: ["25 vulnerabilities in Atlassian MCP disclosed on Sept 22, 2026, all fixed in v0.22.0.", "Critical SSRF (CVE-2026-77254) and high-severity file access flaws dominate the batch.", "Insecure path handling in uploads allows arbitrary file read/write.", "Authentication bypasses and token exposure risks present in multiple CVEs.", "XSS and insecure URL validation also addressed in the coordinated disclosure.", "Users urged to update immediately to version 0.22.0."] title: "Atlassian MCP: 25 Coordinated Vulnerabilities Expose Jira, Confluence Integrations" lede: "A batch of 25 vulnerabilities in Atlassian's MCP server, affecting Jira and Confluence, were disclosed together, with critical flaws enabling SSRF and arbitrary file access."