CVE-2026-77252

Katalog CVE

CVSS 6.5 · Medium EPSS 0,30%

Kerentanan Improper Access Control pada mcp-atlassian mcp atlassian. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, caller-supplied projects_filter and spaces_filter arguments can replace administrator-configured allowlists, and caller-provided project or space clauses can suppress the configured restriction. A caller can search projects or spaces outside the intended boundary when the configured Atlassian credentials can access them. The advisory traces the vulnerable input and processing flow through JIRA_PROJECTS_FILTER, CONFLUENCE_SPACES_FILTER, projects_filter, spaces_filter, SearchMixin.search_issues, and SearchMixin.search, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Rincian

Terbit di NVD

22 September 2026

Terakhir diubah

25 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 20,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-rqwg-9346-fjjv exploit · advisory vendor
• https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460 patch
• https://github.com/sooperset/mcp-atlassian/pull/1448 patch
• https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0 release notes