A Jira and Confluence MCP server let any network caller act as its operator

What happened

Twenty-nine CVE records against mcp-atlassian, the open-source MCP server that connects AI assistants to Jira and Confluence, reached NVD on 22 September 2026, all fixed in version 0.22.0. The worst, CVE-2026-77244, is scored CVSS 3.1 10.0: the HTTP transport accepted requests with no verified user identity and fell back to the operator's own Jira or Confluence credentials, so "a network client that can reach the MCP endpoint can invoke Atlassian tools as the operator". CVE-2026-77254, scored 9.1, is a second route to the same outcome.

The rest of the batch scores 5.3 to 8.8: attachment uploads that take any server-local file path and send the file to Jira or Confluence, SSRF-guard bypasses through DNS rebinding and header-supplied URLs, hidden tools still callable by name (CVE-2026-77243, 8.8), caller filters that override administrator allowlists, and OAuth tokens written to a plaintext file with default permissions. Version 0.22.0 reached PyPI on 10 July 2026, so the records catch up on flaws already fixed; two related records, CVE-2026-73496 and CVE-2026-73497, reached NVD on 14 September.