CVE-2026-77243: MCP Atlassian ENABLED_TOOLS / Toolset Authorization Bypass Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3r68-hf9h-887v",
  "modified" : "2026-09-22T20:34:55Z",
  "published" : "2026-09-22T20:34:55Z",
  "aliases" : [ "CVE-2026-77243" ],
  "summary" : "MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass",
  "details" : "### Summary\n\n`ENABLED_TOOLS` and `TOOLSETS` filters are enforced at `tools/list` time only. `tools/call` dispatches from the full unfiltered tool registry (73 tools). Any user with access to the server endpoint that knows a tool name can invoke it directly. Tool names are not secret since mcp-atlassian is open source. Any direct JSON-RPC call bypasses the restriction entirely.\n\n`READ_ONLY_MODE` is **not** affected: it has dual enforcement at list time (`_list_tools_mcp`) and call time `@check_write_access decorator`. The developers applied the correct pattern to `READ_ONLY_MODE` but not to `ENABLED_TOOLS` or `toolsets` - confirming this is an implementation oversight.\n\n### Impact\n\nAny user with access to the MCP server's HTTP endpoint can invoke any of the 73 registered tools regardless of `ENABLED_TOOLS` or `TOOLSETS` configuration - including write and delete operations on Jira issues, Confluence pages, etc. Operators deploying mcp-atlassian via Streamable HTTP rely on `ENABLED_TOOLS` to enforce least-privilege access; the bypass invalidates that model entirely.\n\nThe security impact concentrates in multi-user / HTTP-transport deployments, where the tool filter is a trust boundary between clients. In a single-user stdio deployment there is no second principal to defend against.\n\n### Details\nIn `src/mcp_atlassian/servers/main.py`, AtlassianMCP overrides `_list_tools_mcp` and applies the `TOOLSETS` and `ENABLED_TOOLS` filters before returning the tool list to clients. The `_call_tool_mcp` handler is not overridden. FastMCP's default `_call_tool_mcp` resolves the tool from the local tool manager / mounted servers, the full unfiltered inventory, so the filters never apply at call time.\n\n\n### Proof of Concept\n\nAll calls are issued against the HTTP transport, with `ENABLED_TOOLS=jira_search` configured - only `jira_search` should be reachable.\n\nStep 1 - negative control: tools/list correctly filters by ENABLED_TOOLS:\n```\nreq → tools/list\n← { \"tools\": [ { \"name\": \"jira_search\" } ] }   # only 1 tool; jira_get_issue / jira_create_issue absent\n```\n\nStep 2 - confidentiality bypass: tools/call dispatches jira_get_issue despite its exclusion from the list:\n```\nreq → tools/call jira_get_issue { \"issue_key\": \"SEC-1\" }\n← { ... issue fields (summary, status, ...) ... }   # executed; not blocked\n```\n\nStep 3 - integrity bypass: tools/call dispatches the write tool jira_create_issue:\n```\nreq → tools/call jira_create_issue\n         { \"project_key\": \"SEC\", \"summary\": \"[PoC] ENABLED_TOOLS bypass\", \"issue_type\": \"Task\" }\n← { ... \"key\": \"SEC-<n>\" ... }   # issue created despite ENABLED_TOOLS=jira_search\n```\n\nStep 1 proves the filter exists and is enforced at list time, so Steps 2–3 are a genuine authorization bypass, not an open/unconfigured endpoint. The same result holds with TOOLSETS=jira_read configured: write tools are absent from tools/list yet execute via tools/call.\n\n**Local reproduction**\n\nExtract `enabled_tools_bypass_tool_authorization.zip`:\n```\n# Fill Atlassian credentials in docker-compose.yml (ENABLED_TOOLS=jira_search is preset);\n# ensure issue SEC-1 exists, or update the project/issue key in poc.sh\ndocker compose up -d        # mcp-atlassian, streamable-http, 0.0.0.0, ENABLED_TOOLS=jira_search\n./poc.sh                    # exits 0 on success\ndocker compose down -v\n```\n\n>Requires Docker, curl, jq, and an Atlassian Cloud site with a Jira project (free tier works). The script runs the three steps above: it confirms tools/list returns only jira_search, then dispatches the excluded jira_get_issue (read) and jira_create_issue (write) via tools/call. The test issue it creates is deleted automatically on exit.\n\n### Credit\nDiscovered by [Francisco Rosales](https://www.linkedin.com/in/francisco-rosales-celis/) of [Manifold Security](https://manifold.security/)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "mcp-atlassian"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.22.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-3r68-hf9h-887v"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-77243"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/sooperset/mcp-atlassian/pull/1448"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/sooperset/mcp-atlassian"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-862" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-22T20:34:55Z",
    "nvd_published_at" : "2026-09-22T18:17:17Z"
  }
}