AdvisoriesToolsStatsChecklistSubmitGet the email
← All tools
MCP · Community (sooperset)

MCP Atlassian

Open-source MCP server that connects AI agents to Jira and Confluence.

1Advisories
1critical
0high
0medium
2026-09-22Latest
MCP Atlassian CVEs & security

Is MCP Atlassian safe?

MCP Atlassian is an open-source MCP server that connects AI agents to Jira and Confluence, usually with your Atlassian credentials.

We track 1 security advisory that affects MCP Atlassian. By severity: 1 critical. It has a CVE ID. It is a broken access control issue. The newest entry is dated 2026-09-22.

Newest entries on this page
Using MCP Atlassian safely
  • Upgrade to 0.22.0 or later.
  • Use the stdio transport unless you need HTTP. If you do, bind to 127.0.0.1 and put real authentication in front.
  • Use per-user tokens with the smallest scope, and rotate your Atlassian API token if the server was reachable from a network.
  • Remember that the agent can read and write Jira and Confluence as you. Treat ticket and page content as untrusted input.
Timeline · advisories per quarter
12026 Q3
Named in sources

Reported for MCP Atlassian

01. criticalBroken access controlCVE-2026-77244: MCP Atlassian's HTTP transport accepts any token and acts with the operator's Jira and Confluence accountBefore 0.22.0, mcp-atlassian's HTTP transport accepts any non-empty token, and requests without a real user identity fall back to the operator's configured Jira or Confluence credentials. Anyone who can reach the MCP endpoint can read and write Jira and Confluence as the operator. MCP Atlassian MCP SDKs & servers 2026-09-22
The weekly email

One email a week. Only what changed.

Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.