{
 "id": "AIR-2026-0174",
 "slug": "cve-2026-77251-mcp-atlassian-access-control-bypass-in-search",
 "title": "CVE-2026-77251: MCP Atlassian access control bypass in search and board APIs",
 "summary": "An access control flaw in MCP Atlassian before 0.22.0 permits callers to query restricted Jira projects, Confluence spaces, or boards. Incomplete validation of syntax and filters allows unauthorized data access when broader credentials are used.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "mcp-atlassian"
 ],
 "incident_date": "2026-09-22",
 "incident_date_precision": "day",
 "first_reported": "2026-09-22",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77251",
   "publisher": "NVD",
   "title": "CVE-2026-77251: MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).",
   "published_at": "2026-09-22"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-77251",
  "mcp",
  "atlassian"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}