{
 "id": "AIR-2026-0172",
 "slug": "cve-2026-77246-mcp-atlassian-allows-unauthorized-transport-a",
 "title": "CVE-2026-77246: MCP Atlassian allows unauthorized transport and request manipulation",
 "summary": "An authorization bypass vulnerability in MCP Atlassian prior to version 0.22.0 allows attackers to send requests without proper identity checks and manipulate service headers. The flaw can be combined with file upload tools to transmit server-local files.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "mcp-atlassian"
 ],
 "incident_date": "2026-09-22",
 "incident_date_precision": "day",
 "first_reported": "2026-09-22",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77246",
   "publisher": "NVD",
   "title": "CVE-2026-77246: MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).",
   "published_at": "2026-09-22"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-77246",
  "mcp",
  "atlassian"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}