CVE-2026-77251: MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)

Operators set JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER to confine an MCP client to part of a workspace, usually because the API token can see more than the agent should. The filter failed in three places.

In jira/search.py, the server appended AND project in (...) only if the JQL did not contain the text project = . A query that names a project outside the allowlist, such as project = SECRET, passed the check and went to Jira unchanged. In confluence/search.py the same pattern applied, and the check for space = was case sensitive, so SPACE = "PRIVATE" slipped through. The agile tools get_agile_boards and get_board_issues had no filter check at all, so they listed every board and returned its issues.

The attacker needs to steer the MCP client, for example through a prompt injection in a ticket or page the agent reads, and the token must cover more than the allowlist. The result is read access to other projects and spaces. The reporter reproduced the Jira search bypass against Atlassian Cloud with version 0.21.1. The Confluence and board cases were verified in code.

All mcp-atlassian releases below 0.22.0 are affected when JIRA_PROJECTS_FILTER or CONFLUENCE_SPACES_FILTER is relied on as an access boundary. Without a filter there is no boundary to bypass, though the token's own reach still applies.

pip show mcp-atlassian

If you run it through uvx or a container, check the image tag or pinned version in your MCP client configuration.

Upgrade to 0.22.0:

pip install --upgrade mcp-atlassian==0.22.0

Per the release notes, the project and space filters are now always ANDed into queries, so callers can narrow results but not widen them. This covers search and board issue queries. Sprint IDs are also validated as numeric to block JQL injection. As an extra control, issue the Atlassian token with only the scopes and projects the agent needs, because a client-side filter should not be your only boundary.

Review Jira and Confluence audit logs for searches made by the MCP service account that reference projects or spaces outside your allowlist. In MCP server logs, look for jira_search calls whose jql contains project = with a key not in your filter, confluence_search cql using uppercase SPACE =, and any get_agile_boards or get_board_issues calls. Beam can record agent MCP tool calls so you can review these queries alongside the agent session that issued them.

Summary

mcp-atlassian is a popular community MCP server wrapper exposing Jira / Confluence to MCP clients. Operators commonly restrict the surface to a small allowlist of projects/spaces via the JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER environment variables, which the README documents as the principal mechanism for limiting attacker-controlled MCP clients (= prompt-injected LLM agents) to the operator's intended subset of the workspace.

We identified three distinct sub-bugs that let attacker-controlled queries read content from forbidden projects/spaces (= projects NOT in the operator's filter) despite the filter being correctly set. The most severe is empirically reproduced on production Atlassian Cloud with real operator credentials and sentinel content in two real projects.

| Sub-bug | Layer | Class | Live? |
| **A1** | Jira `jira_search` `jql` | substring-bypass | 🔴 **LIVE PROVEN 2026-05-18 on real Atlassian Cloud** |
| **A2** | Confluence `confluence_search` `cql` | case-sensitive substring-bypass | code-level verified |
| **B** | Jira agile `get_board_issues` / `get_agile_boards` | zero-filter (missing check) | code-level verified |

Details

Sub-bug A1 — src/mcp_atlassian/jira/search.py lines 92-94 at HEAD d8bc78698a63cb6b321c7ca796d6329d448f7f6d:

if projects_filter and "project = " not in jql.lower():
    jql = f"{jql} AND project in ({','.join(projects_filter)})"

The substring check is satisfied by *any* JQL of the form project = <forbidden-project> — including a project NOT in projects_filter. The wrapper does NOT verify that the project named in the user JQL is a member of the allowlist. The user-supplied JQL is sent verbatim to Jira's search API which returns content from the forbidden project (Jira's authorization is satisfied because the operator's PAT typically has broader access than the operator's intended allowlist — which is *why* the operator set a filter in the first place).

Sub-bug A2 — src/mcp_atlassian/confluence/search.py line 60: same pattern as A1, PLUS the substring check "space = " not in cql is case-sensitive (no .lower()). User CQL SPACE = "<forbidden-space>" (uppercase) bypasses the substring match.

Sub-bug B — get_board_issues and get_agile_boards paths have no `projects_filter` enforcement at all — no substring check, no AST walk, the allowlist is silently ignored. An MCP client invoking get_agile_boards enumerates boards across the entire workspace (including forbidden projects), and get_board_issues(boardId=<forbidden-board>) returns all issues with no filter check.

PoC

End-to-end Phase C against real Atlassian Cloud + real mcp-atlassian Python binary v0.21.1 (latest on PyPI) with operator-provided test workspace and two real Jira projects (one allowed, one forbidden via JIRA_PROJECTS_FILTER):

| Step | JQL submitted | Result | Verdict |
| 1 initialize | – | MCP 2024-11-05 OK | ✓ |
| 2 tools/list | – | 33+ tools incl. `jira_search` | ✓ |
| 3 CONTROL | `project = <allowed>` | returns allowed issue | ✓ |
| 4 NEG CTRL | `summary ~ "any-string"` | wrapper appends `AND project in (<allowed>)` → 0 forbidden results | ✓ |
| 5 **BYPASS A1** | `project = <forbidden>` | **returns forbidden issue with sentinel content** | 🔴 **BYPASS** |

Full RPC log and a reproducible test script are available in a disclosure bundle I have prepared. I can share the zip via a private channel (email / your preferred private fork / encrypted upload) — please reply with your preference. The bundle includes:

• 00-FINDING-REPORT.md (primary report)
• ATTACK-MATRIX.md
• Verbatim source files at HEAD with sha256 chain of custody (source-jira-search.py, source-confluence-search.py)
• Phase C live test script + JSON-RPC witness log
• Bundle zip sha256: 034cbf0bcb66c325be9373ff2dc186b8b0e1747c5165d6fba3bca83054949dd3

Repro recipe (no bundle needed) :

pip install mcp-atlassian
export JIRA_URL=https://<your-test-workspace>.atlassian.net
export JIRA_USERNAME=<your-test-email>
export JIRA_API_TOKEN=<your-pat>
export JIRA_PROJECTS_FILTER=<your-allowed-project-key>
# Then drive the MCP via stdio JSON-RPC with tools/call jira_search jql="project = <forbidden-project-key>"
# Expect: forbidden project content returned despite the filter.

Impact

Severity is higher in deployments where the operator's PAT covers a broader set of projects than JIRA_PROJECTS_FILTER (= the common configuration, which is the reason operators set the filter).

Affected: every operator who relies on JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER to confine an attacker-controlled MCP client (= prompt-injected LLM agent) to a subset of their workspace.

Suggested fix

1. Replace substring checks with AST-based JQL/CQL parsers that walk the WHERE clause looking for project/space constraints. Reject queries whose project/space constraint references a key not in the allowlist.
2. Add projects_filter check inside get_board_issues (resolve board → project, reject if not in filter) and get_agile_boards (filter returned list).
3. Make the Confluence substring check case-insensitive (cql.lower()) for defense-in-depth, even after the AST fix lands.
4. Default-deny for ambiguous queries: if the AST parser can't fully classify a clause, refuse instead of pass-through.
5. Add unit tests that assert attacker JQL project = <not-in-filter> returns zero results when the filter is set.

Disclosure

ISO/IEC 29147. Default 90-day embargo from the date you acknowledge receipt. Happy to coordinate the CVE via the GitHub CNA pipeline. Credit under: Mordehai Attia, Founder, Corsen AI (https://corsen.ai , GitHub @CorsenAI).

Thank you for maintaining mcp-atlassian — the project is widely used and your security policy was clear, which made this disclosure straightforward to file. Looking forward to coordinating the fix.