What happened
NVD published a 25-CVE cluster on 2026-09-22 all fixed together in mcp-atlassian 0.22.0, led by CVE-2026-77244 (CVSS 10.0): the HTTP transport accepts requests without a verified user identity and falls back to the operator's global Jira/Confluence credentials, giving any reachable caller full operator-level tool access. Companion CVEs cover unrestricted caller-controlled file paths in attachment upload tools (arbitrary server-local file read/exfiltration), SSRF guards undermined by DNS-rebinding/backslash-authority confusion, missing re-checks of ENABLED_TOOLS/TOOLSETS on dispatch, OAuth token files written with permissive umask permissions, and header-driven fetcher construction without SSRF validation (CVE-2026-77242 through CVE-2026-77274).
Why it matters
This is an agentic tool surface that converts a remotely reachable MCP endpoint into a bridge into the operator's Atlassian tenant and the server's local filesystem: an unauthenticated caller can read the operator's customer/project data in Jira/Confluence, alter tickets/pages, and exfiltrate server-local secrets via attachment-upload tools — without defeating the model at all. It is the same product line previously weaponized in an unauthenticated RCE+SSRF chain (CVE-2026-27825/27826) that showed up on a cybercrime forum.
Attack vector
A network caller reaching the exposed MCP HTTP endpoint sends requests with no/any Authorization token. AtlassianOpaqueTokenVerifier accepts any non-empty token and the middleware does not reject header-less requests; tool handlers then fall back to the operator's globally-configured env credentials, so the attacker invokes Jira/Confluence read/write tools as the operator. Companion bugs in the same fix allow the same caller to pass an arbitrary file_path to upload-attachment tools (reads server-local files and exfiltrates them to an attacker-selected attachment URL) and to bypass SSRF guards via DNS-rebinding/backslash-authority confusion.
Affected systems
mcp-atlassian (PyPI/GitHub sooperset) < 0.22.0
Mitigation
Upgrade to mcp-atlassian 0.22.0 (commit b041733473f95119dd539542a43c280737a8e460). For the broader risk: do not expose the MCP transport without a terminating auth proxy, enforce MCP_ALLOWED_URL_DOMAINS, restrict filesystem/workspace paths, and treat agent tool output as untrusted input.