# mcp-atlassian Credential Leak via Hint Parameter Injection (CVE-2026-27825/27826)

- **Severity:** Critical
- **Signature ID:** `52fe7a75-cf73-4c20-8e01-6d1b7d5cd8a5`
- **CVEs:** CVE-2026-27825, CVE-2026-27826
- **MITRE ATLAS:** AML.T0051.001 (Indirect), AML.T0056 (Extract LLM System Prompt)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI06 (Goal and Instruction Manipulation), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

Two tools in the mcp-atlassian integration accept a free-text 'hint' field that gets passed straight into the AI agent's context without any filtering. An attacker can hide instructions in that hint telling the agent to repeat back its cookies, OAuth session, or API key in its next reply, effectively stealing the credentials the agent uses to talk to Jira and Confluence.

## How the attack works

An attacker crafts a hint value for the jira_cloud_id or confluence_spaces tool that contains a hidden instruction rather than a normal hint. The mcp-atlassian server forwards this text unsanitized into the LLM's context window. The agent, treating the injected text as a legitimate instruction, follows it and includes the active Atlassian OAuth cookie, Authorization header, or X-API-Key value in its next output. Whoever controls the input channel (or reads the agent's output) then has a working credential for the Atlassian session.

## Why it matters

An attacker who can reach either tool's hint parameter can obtain live Jira or Confluence session credentials, giving them the same access as the compromised agent — potentially reading or modifying tickets, pages, and other Atlassian data without needing to break authentication themselves.

## What you can do

- Upgrade mcp-atlassian to 0.17.0 or later, which fixes the unsanitized hint handling.
- Until patched, block or filter any hint parameter values that reference cookies, headers, tokens, or authorization data before they reach the LLM.
- Review agent output logs for messages containing cookie, Authorization, or X-API-Key strings following jira_cloud_id or confluence_spaces calls.
- Restrict who or what can supply values to these two tool parameters, since the attack requires attacker-controlled input reaching the hint field.

## Known benign look-alikes

- Legitimate mcp-atlassian skill documentation that shows valid hint parameter usage without credential-extraction directives.
- Security research content describing the CVE-2026-27825/27826 attack pattern as a reference sample.
- Tool descriptions that mention cookie or token in an educational or remediation context.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00212
- https://nvd.nist.gov/vuln/detail/CVE-2026-27825
- https://nvd.nist.gov/vuln/detail/CVE-2026-27826

---
Source: https://www.netzilo.com/threats/atr-mcp-atlassian-credential-leak-via-hint-parameter-injection-c