User-controlled boolean query grouping defeated the MCP-level Jira and Confluence allowlists. Entry and authority. An MCP client controls a JQL or CQL query interpreted alongside a project/space restriction. Observed mechanism and consequence. Malformed parentheses and OR precedence allow results beyond the configured filter; version 0.24.1 repairs…
Inspect the ClaimsCase · DiggingBeagle record
MCP Atlassian JQL and CQL expressions escaped resource filters
User-controlled boolean query grouping defeated the MCP-level Jira and Confluence allowlists.
Public disclosure: Nov 8, 2026
Scope
An MCP client controls a JQL or CQL query interpreted alongside a project/space restriction. Malformed parentheses and OR precedence allow results beyond the configured filter; version 0.24.1 repairs expression validation and post-filtering.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-GHSA-7VJF-5WH5-87Q7; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-ATL-GHSA-7VJF-5WH5-87Q7-01 · CLM-DB233-ATL-GHSA-7VJF-5WH5-87Q7-02 · mcp-atlassian advisory GHSA-7vjf-5wh5-87q7
At a glance
No confirmed production exploitation and no escalation beyond the backing Atlassian credential.
Limits and uncertaintyFull account
User-controlled boolean query grouping defeated the MCP-level Jira and Confluence allowlists.
Entry and authority. An MCP client controls a JQL or CQL query interpreted alongside a project/space restriction.
Observed mechanism and consequence. Malformed parentheses and OR precedence allow results beyond the configured filter; version 0.24.1 repairs expression validation and post-filtering.
Limits and status. No confirmed production exploitation and no escalation beyond the backing Atlassian credential.
An MCP search wrapper appended the project or space allowlist to a caller-supplied JQL/CQL expression. Crafted grouping and boolean precedence could change which records matched, allowing results outside the intended MCP selection. The backing Atlassian credential still determines what Jira or Confluence itself permits, so this is a failure of delegated scope rather than a bypass of all Atlassian account access controls.
Mechanism and trust boundary
- 01
Precondition and trust context
An MCP client controls a JQL or CQL query interpreted alongside a project/space restriction.
- 02
Crossed boundary
Malformed parentheses and OR precedence allow results beyond the configured filter; version 0.24.1 repairs expression validation and post-filtering.
- 03
Observed limit
No confirmed production exploitation and no escalation beyond the backing Atlassian credential.
Timeline
- Nov 8, 2026Event type unspecified
Initial documented finding
MCP Atlassian JQL and CQL expressions escaped resource filters
- Nov 8, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-ATL-GHSA-7VJF-5WH5-87Q7-01The GHSA-7vjf-5wh5-87q7 advisory documents that malformed parentheses and OR precedence allow results beyond the configured filter; version 0.24.1 repairs expression validation and post-filtering.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-7vjf-5wh5-87q7primary disclosure
Advisory: Summary and Details
CLM-DB233-ATL-GHSA-7VJF-5WH5-87Q7-02The disclosed precondition is: An MCP client controls a JQL or CQL query interpreted alongside a project/space restriction.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-7vjf-5wh5-87q7primary disclosure
Advisory: Affected configurations and reproduction
Controls and mitigations
- Apply post-query resource validation and safe expression construction; the project reports a fix in 0.24.1.
- Constrain the delegated Jira/Confluence token to the same resources wherever possible, rather than relying on filtering alone.
Unknowns and contradictions
- No confirmed production exploitation and no escalation beyond the backing Atlassian credential.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235