sooperset/mcp-atlassian v0.24.1

on GitHub

🔒 Security

This release fixes security issues reported privately. Details are in each advisory. Upgrade if you run the HTTP transports (sse, streamable-http), use JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER, or let tools read and write files on the server.

Project and space filters

• GHSA-xv8h-26ch-vfh9: the project and space filters now apply to every tool, including writes and header-PAT requests.
• GHSA-7vjf-5wh5-87q7: user JQL and CQL can no longer step outside the filter.

Server-side requests and credentials

• GHSA-rh5v-38gg-q3jj, GHSA-jpxv-989p-f3pf: URLs supplied in request headers are no longer trusted like the operator's URLs.
• GHSA-3c6h-qwx8-hjcm, GHSA-3qhx-3fh4-8w9v: credentials, custom headers and the operator proxy go only to the exact configured origin.
• GHSA-pwx2-x8g8-prvm: Forms API calls use the hardened session.
• GHSA-85p8-f4j5-j5jp: IPv6 transition addresses are judged by their embedded IPv4.

Files and attachments

• GHSA-qh7q-jmc7-rc7j, GHSA-823g-2jmv-9gmc: tool file paths stay inside an explicit directory.
• GHSA-cf68-pxw7-c8fr: Confluence attachment ids are validated.
• GHSA-8ffx-6c2g-75cc: remove_issue_link takes only a numeric link_id.

Authentication and logs

• GHSA-2w5r-h8v2-c9cx: every method on the MCP transport paths is authenticated.
• GHSA-5w8q-mmhc-55fp, GHSA-rwqj-c54w-32jr, GHSA-7876-w4xp-76fv: the OAuth setup callback binds to loopback, rejects a mismatched state, escapes its output and keeps secrets out of logs.
• GHSA-cffg-pgvw-r443: debug header logs redact every non-standard header.

⚠️ Upgrade notes

• File directory. On sse and streamable-http, tools that read or write server files use MCP_ATLASSIAN_FILES_DIR, or ~/.mcp-atlassian/files when it is unset. They no longer use the working directory. The server refuses to start if that directory is / or your home directory. stdio is unchanged.
• Filters apply everywhere. With JIRA_PROJECTS_FILTER or CONFLUENCE_SPACES_FILTER set, each tool looks up the target's project or space before running and refuses if it can't confirm it. JQL and CQL must be one balanced expression. Issue output drops parent, subtask, link and epic references outside the filter. Boards without a project location are allowed only when all their projects are allowed.
• Exact origin for credentials. Credentials go only to the scheme, host and port in JIRA_URL / CONFLUENCE_URL. If your Jira or Confluence base URL differs from that value (for example http:// or :8080), attachment downloads can return 401. Add that host to MCP_ALLOWED_URL_DOMAINS.
• Transport auth. All methods under /mcp, /sse and /messages/ are authenticated, including OPTIONS. Handle CORS preflight in your reverse proxy.
• Warnings. HTTP transports warn at startup when MCP_ALLOWED_URL_DOMAINS is unset; it becomes required in v0.25. Passing secrets as command-line options (--jira-token and similar) now warns; use environment variables or --env-file.
• OAuth setup. --oauth-setup listens on 127.0.0.1 only. Use SSH port forwarding if your browser runs on another machine.
• Forms. form_id must be a UUID.

Contributors

Thanks to everyone who reported these issues privately. Reporters are credited on each advisory.

Full Changelog: v0.24.0...v0.24.1