CVE-2026-77244: mcp-atlassian Over HTTP Ran Anonymous Requests as the Operator, and the SSE Transport Stayed Open Until 0.23.1 (CVSS 10.0)

NVD published CVE-2026-77244 on 22 September 2026 (GHSA-wrhw-j3f9-8vc6, CVSS 3.1 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). Before 0.22.0, the sooperset mcp-atlassian server's HTTP transport accepted requests with no verified user identity: AtlassianOpaqueTokenVerifier accepted any non-empty token, and the Jira/Confluence fetchers fell back to the operator's globally configured credentials. Anyone who could reach the endpoint could call every Atlassian tool, read and write, as the account that deployed the server. 0.22.0 (10 July 2026) returns 401 at the transport boundary and makes global-credential fallback opt-in via ALLOW_GLOBAL_CRED_FALLBACK. A sibling advisory, GHSA-5j8j-256g-vvp5 (published 19 August, GitHub CVSS 10.0, no CVE yet), showed that under `--transport sse` the auth middleware only matched the /mcp path, never /sse or /messages/, so SSE requests skipped authentication entirely and valid headers were dropped; operators who enabled ALLOW_GLOBAL_CRED_FALLBACK to make SSE work put every anonymous request back on the operator token. That path is fixed in 0.23.1. This is a different flaw from CVE-2026-73498 (ti-094, confluence_upload_attachment file read), which needs an authenticated client.

You are affected if you run mcp-atlassian <0.23.1. Versions 0.23.1 and later include the fix.

Upgrade mcp-atlassian to 0.23.1 or later (0.22.0 alone leaves the SSE path open), and rebuild any container image built before 19 August 2026. Leave ALLOW_GLOBAL_CRED_FALLBACK off; if a shared HTTP/SSE deployment only worked with it on, that deployment was running every anonymous caller as the operator. Prefer per-user stdio servers for developer agents; where a shared HTTP server is required, bind it to a private network behind an authenticating proxy. If an affected version was reachable beyond localhost, rotate the operator's Atlassian API token or PAT and review Jira and Confluence audit logs for changes made by that account that no human requested.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run mcp-atlassian and which version, then enforce a policy on it.