# MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)

mcp-atlassian's JIRA_PROJECTS_FILTER/CONFLUENCE_SPACES_FILTER allowlist is bypassed by substring checks, letting prompt-injected MCP clients read forbidden Jira projects and Confluence spaces.

- Payout: Research
- Severity: high
- Program: mcp-atlassian
- Found by: CorsenAI
- Disclosed: 2026-09-22
- CVE: CVE-2026-77251
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-w66g-j6c4-hcfc
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-w66g-j6c4-hcfc
- Tags: area:ai domain:ai domain:api impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:llm technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** MCP server Jira/Confluence search tools (jira_search jql, confluence_search cql, agile board tools)
**Root cause:** The allowlist is enforced by a naive substring check (`"project = " not in jql.lower()`) that any user JQL containing `project = <forbidden>` satisfies, and the Confluence check is additionally case-sensitive; the agile board tools enforce no filter at all.
**Steps:**
1. Set `JIRA_PROJECTS_FILTER=<allowed-project-key>` and connect an MCP client to mcp-atlassian v0.21.1.
2. Call `jira_search` with `jql="project = <forbidden-project-key>"`.
3. Wrapper sees `project = ` substring present, skips appending `AND project in (<allowed>)`, forwards JQL verbatim to Jira.
4. Jira returns forbidden project issues because the operator PAT has broader access than the intended allowlist.
5. For Confluence: call `confluence_search` with `cql="SPACE = \"<forbidden-space>\""` (uppercase) to bypass the case-sensitive check.
6. For agile: call `get_agile_boards` / `get_board_issues(boardId=<forbidden-board>)` — no filter check exists.
**How found:** Code review of the filter enforcement in search.py: noticed the guard is a substring test rather than a parse of the JQL/CQL, and that the Confluence variant omits `.lower()`; then checked the agile board code paths and found no filter enforcement at all.
**Exploitation:** A prompt-injected LLM agent driving the MCP server issues a crafted JQL/CQL or agile board call; the wrapper's filter is skipped and the operator's PAT retrieves content from projects/spaces outside the intended allowlist, exfiltrating it back through the agent.
**Insight:** When an allowlist is enforced by substring-matching a query language, any query that literally contains the guard token (`project = `, `space = `) disables the appended constraint — test case variants and alternate tool paths (agile/board APIs) that skip the guard entirely.