Shared MCP service credentials could reach objects excluded by operator allowlists. Entry and authority. An operator restricts the MCP server to selected Jira projects or Confluence spaces while its backing Atlassian credential remains broader. Observed mechanism and consequence. Most read-by-key and mutation tools failed to consult those filters; the…
Inspect the ClaimsCase · DiggingBeagle record
MCP Atlassian tool methods skipped project and space allowlists
Shared MCP service credentials could reach objects excluded by operator allowlists.
Public disclosure: Nov 8, 2026
Scope
An operator restricts the MCP server to selected Jira projects or Confluence spaces while its backing Atlassian credential remains broader. Most read-by-key and mutation tools failed to consult those filters; the 0.24.1 release applies per-resource checks.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-GHSA-XV8H-26CH-VFH9; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-ATL-GHSA-XV8H-26CH-VFH9-01 · CLM-DB233-ATL-GHSA-XV8H-26CH-VFH9-02 · mcp-atlassian advisory GHSA-xv8h-26ch-vfh9
At a glance
This does not demonstrate bypass of the underlying Atlassian principal permissions.
Limits and uncertaintyFull account
Shared MCP service credentials could reach objects excluded by operator allowlists.
Entry and authority. An operator restricts the MCP server to selected Jira projects or Confluence spaces while its backing Atlassian credential remains broader.
Observed mechanism and consequence. Most read-by-key and mutation tools failed to consult those filters; the 0.24.1 release applies per-resource checks.
Limits and status. This does not demonstrate bypass of the underlying Atlassian principal permissions.
The integration advertised project and space filters as an MCP-level restriction but applied them to only part of the tool inventory. Direct object reads, comments, attachments, worklogs and mutations could take identifiers outside that filter when the shared Atlassian service account itself had broader access. The first-party advisory documents a central enforcement repair in 0.24.1; it does not claim Atlassian's own permission service was compromised.
Mechanism and trust boundary
- 01
Precondition and trust context
An operator restricts the MCP server to selected Jira projects or Confluence spaces while its backing Atlassian credential remains broader.
- 02
Crossed boundary
Most read-by-key and mutation tools failed to consult those filters; the 0.24.1 release applies per-resource checks.
- 03
Observed limit
This does not demonstrate bypass of the underlying Atlassian principal permissions.
Timeline
- Nov 8, 2026Event type unspecified
Initial documented finding
MCP Atlassian tool methods skipped project and space allowlists
- Nov 8, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-ATL-GHSA-XV8H-26CH-VFH9-01The GHSA-xv8h-26ch-vfh9 advisory documents that most read-by-key and mutation tools failed to consult those filters; the 0.24.1 release applies per-resource checks.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-xv8h-26ch-vfh9primary disclosure
Advisory: Summary and Details
CLM-DB233-ATL-GHSA-XV8H-26CH-VFH9-02The disclosed precondition is: An operator restricts the MCP server to selected Jira projects or Confluence spaces while its backing Atlassian credential remains broader.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-xv8h-26ch-vfh9primary disclosure
Advisory: Affected configurations and reproduction
Controls and mitigations
- Apply resource-specific allowlists before every effectful MCP read and write, including newly introduced tools; use the 0.24.1 fix.
- Reduce the Atlassian account's actual privilege and audit out-of-scope tool calls instead of relying on an MCP-side search filter.
Unknowns and contradictions
- This does not demonstrate bypass of the underlying Atlassian principal permissions.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235