The tool accepted public=false while Jira Service Management posted a visible notification. Entry and authority. An agent invokes jira_add_comment with an internal-only setting against a JSM ticket. Observed mechanism and consequence. The server sometimes created a public customer-visible comment and email notification instead; 0.24.0 uses the internal…
Inspect the ClaimsCase · DiggingBeagle record
MCP Atlassian internal Jira comments were exposed as customer-visible notes
The tool accepted public=false while Jira Service Management posted a visible notification.
Public disclosure: Nov 8, 2026
Scope
An agent invokes jira_add_comment with an internal-only setting against a JSM ticket. The server sometimes created a public customer-visible comment and email notification instead; 0.24.0 uses the internal ServiceDesk API and fails closed.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-GHSA-Q2H8-FM7R-V7F2; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-ATL-GHSA-Q2H8-FM7R-V7F2-01 · CLM-DB233-ATL-GHSA-Q2H8-FM7R-V7F2-02 · mcp-atlassian advisory GHSA-q2h8-fm7r-v7f2
At a glance
Controlled finding; real customers receiving sensitive notes not confirmed and emailed copies cannot be recalled.
Limits and uncertaintyFull account
The tool accepted public=false while Jira Service Management posted a visible notification.
Entry and authority. An agent invokes jira_add_comment with an internal-only setting against a JSM ticket.
Observed mechanism and consequence. The server sometimes created a public customer-visible comment and email notification instead; 0.24.0 uses the internal ServiceDesk API and fails closed.
Limits and status. Controlled finding; real customers receiving sensitive notes not confirmed and emailed copies cannot be recalled.
The caller supplied public=false to the MCP tool intending an internal note. The integration previously posted through an API that could create a customer-visible Service Management comment and trigger notification. A successful MCP response therefore did not imply the requested confidentiality property. The response fix is documented from 0.24.0; an already sent customer notification cannot be recalled by changing the tool.
Mechanism and trust boundary
- 01
Precondition and trust context
An agent invokes jira_add_comment with an internal-only setting against a JSM ticket.
- 02
Crossed boundary
The server sometimes created a public customer-visible comment and email notification instead; 0.24.0 uses the internal ServiceDesk API and fails closed.
- 03
Observed limit
Controlled finding; real customers receiving sensitive notes not confirmed and emailed copies cannot be recalled.
Timeline
- Nov 8, 2026Event type unspecified
Initial documented finding
MCP Atlassian internal Jira comments were exposed as customer-visible notes
- Nov 8, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-ATL-GHSA-Q2H8-FM7R-V7F2-01The GHSA-q2h8-fm7r-v7f2 advisory documents that the server sometimes created a public customer-visible comment and email notification instead; 0.24.0 uses the internal ServiceDesk API and fails closed.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-q2h8-fm7r-v7f2primary disclosure
Advisory: Summary and Details
CLM-DB233-ATL-GHSA-Q2H8-FM7R-V7F2-02The disclosed precondition is: An agent invokes jira_add_comment with an internal-only setting against a JSM ticket.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-q2h8-fm7r-v7f2primary disclosure
Advisory: Affected configurations and reproduction
Controls and mitigations
- Use Jira Service Management's internal-comment route and fail if internal visibility cannot be established; upgrade to a version with the 0.24.0 fix.
- Audit existing automation for sensitive comments and verify resulting customer-visible state and notifications after posting.
Unknowns and contradictions
- Controlled finding; real customers receiving sensitive notes not confirmed and emailed copies cannot be recalled.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235