Exact method/path matching left related message endpoints outside the auth gate. Entry and authority. An HTTP/SSE MCP server uses middleware guarding only exact request paths. Observed mechanism and consequence. Mounted Starlette variants of the paths or methods bypassed that middleware; 0.24.1 broadens protection. Limits and status. Bypassing middleware…
Inspect the ClaimsCase · DiggingBeagle record
MCP Atlassian SSE authentication missed mounted HTTP paths and methods
Exact method/path matching left related message endpoints outside the auth gate.
Public disclosure: Nov 8, 2026
Scope
An HTTP/SSE MCP server uses middleware guarding only exact request paths. Mounted Starlette variants of the paths or methods bypassed that middleware; 0.24.1 broadens protection.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-GHSA-2W5R-H8V2-C9CX; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-ATL-GHSA-2W5R-H8V2-C9CX-01 · CLM-DB233-ATL-GHSA-2W5R-H8V2-C9CX-02 · mcp-atlassian advisory GHSA-2w5r-h8v2-c9cx
At a glance
Bypassing middleware did not prove a privileged tool effect or completed sensitive operation.
Limits and uncertaintyFull account
Exact method/path matching left related message endpoints outside the auth gate.
Entry and authority. An HTTP/SSE MCP server uses middleware guarding only exact request paths.
Observed mechanism and consequence. Mounted Starlette variants of the paths or methods bypassed that middleware; 0.24.1 broadens protection.
Limits and status. Bypassing middleware did not prove a privileged tool effect or completed sensitive operation.
The middleware checked a narrow pairing of HTTP method and exact request path while Starlette's mounted transport accepted additional path shapes and methods. The reported reproduction bypassed the middleware's authentication response, but it did not trace a privileged MCP tool operation to completion. Those are different outcomes: entrance through a route is not proof of successful action through that route.
Mechanism and trust boundary
- 01
Precondition and trust context
An HTTP/SSE MCP server uses middleware guarding only exact request paths.
- 02
Crossed boundary
Mounted Starlette variants of the paths or methods bypassed that middleware; 0.24.1 broadens protection.
- 03
Observed limit
Bypassing middleware did not prove a privileged tool effect or completed sensitive operation.
Timeline
- Nov 8, 2026Event type unspecified
Initial documented finding
MCP Atlassian SSE authentication missed mounted HTTP paths and methods
- Nov 8, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-ATL-GHSA-2W5R-H8V2-C9CX-01The GHSA-2w5r-h8v2-c9cx advisory documents that mounted Starlette variants of the paths or methods bypassed that middleware; 0.24.1 broadens protection.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-2w5r-h8v2-c9cxprimary disclosure
Advisory: Summary and Details
CLM-DB233-ATL-GHSA-2W5R-H8V2-C9CX-02The disclosed precondition is: An HTTP/SSE MCP server uses middleware guarding only exact request paths.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-2w5r-h8v2-c9cxprimary disclosure
Advisory: Affected configurations and reproduction
Controls and mitigations
- Protect the entire mounted HTTP/SSE router, including method aliases, path suffixes and relevant preflight requests; update mcp-atlassian to 0.24.1 or later containing the stated fix.
- Verify authentication at the actual tool-dispatch boundary as well as the HTTP transport.
Unknowns and contradictions
- Bypassing middleware did not prove a privileged tool effect or completed sensitive operation.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235