Summary
MCP Atlassian's HTTP transport may accept requests without verifying the caller's identity, then use the operator's globally configured Jira or Confluence credentials. A reachable network client could invoke available Atlassian tools as that operator, potentially performing both read and write actions.
Affected context
The issue occurs in MCP Atlassian deployments using the HTTP transport before identity verification is reliably enforced. When requests lack a verified user identity, downstream fetcher construction may fall back to globally configured Jira or Confluence credentials, allowing tool calls to execute with the operator's privileges.
Exploit preconditions
- Attack surface: MCP Atlassian HTTP endpoint
- Required access: Network connectivity to the MCP endpoint; a valid authenticated user identity may not be required
- Trigger point: Invocation of Atlassian tools through the streamable HTTP transport
- Why exploitation is possible: Identity verification can be bypassed or omitted, while downstream credential handling falls back to the operator's configured Atlassian credentials
Why this happens
The vulnerability results from an authentication design flaw in which an HTTP request can reach privileged tool-processing code without a verified user identity. The fetcher-construction path then treats globally configured operator credentials as an acceptable fallback, causing actions to execute under an unintended security principal. This maps primarily to CWE-287: Improper Authentication, with related exposure involving missing authorization checks under CWE-862 and authentication bypass behavior under CWE-303.
Potential impact
- An attacker may read Jira or Confluence data available to the operator
- An attacker could create, modify, or delete Atlassian resources permitted by the operator account
- Sensitive project information, documents, or issue data may be disclosed
- Unauthorized changes could affect workflows, records, or integrations
- Compromised operator credentials could enable broader access within connected Atlassian environments
General mitigation guidance
Mitigation should focus on making verified identity and authorization mandatory before any tool or fetcher construction occurs.
Common defensive patterns include:
- Rejecting requests that lack a validated user identity
- Preventing global operator credentials from serving as implicit request credentials
- Binding downstream Atlassian access tokens to the authenticated request context
- Enforcing per-tool and per-resource authorization checks
- Applying least privilege to service accounts and integration credentials
- Using explicit deny-by-default behavior for unauthenticated and unauthorized requests
- Separating administrative configuration credentials from user-initiated tool execution
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis of HTTP middleware and authentication-verification paths
- Code review checks for credential fallbacks after failed or missing identity validation
- Tests confirming that unauthenticated requests cannot construct fetchers or invoke tools
- Policy checks requiring authentication and authorization before sensitive downstream calls
- Runtime monitoring for Atlassian actions performed without a corresponding verified identity
- Audit correlation between MCP requests, resolved principals, and Jira or Confluence operations
Automated code review and security scanning tools may help identify unchecked authentication results and implicit credential usage.
