Evidence · DiggingBeagle record
mcp-atlassian advisory GHSA-q2h8-fm7r-v7f2
Original mcp-atlassian security advisory for mcp atlassian internal jira comments were exposed as customer-visible notes.
- Published
- Nov 8, 2026
- Source role
- primary disclosure
Evidence record
Original mcp-atlassian security advisory for mcp atlassian internal jira comments were exposed as customer-visible notes.
Claim-level citations (2)
- supportsMCP Atlassian internal Jira comments were exposed as customer-visible notes: The GHSA-q2h8-fm7r-v7f2 advisory documents that the server sometimes created a public customer-visible comment and email notification instead; 0.24.0 uses the internal ServiceDesk API and fails closed.
Advisory: Summary and Details
- supportsMCP Atlassian internal Jira comments were exposed as customer-visible notes: The disclosed precondition is: An agent invokes jira_add_comment with an internal-only setting against a JSM ticket.
Advisory: Affected configurations and reproduction