mcp-atlassian HTTP Transport Authentication Bypass (CVE-2026-77244)

let mcpPorts = dynamic(["8000", "9000"]);
let suspiciousPaths = dynamic(["/mcp", "/sse", "/messages"]);
// Detect requests to mcp-atlassian HTTP transport carrying an arbitrary bearer token
W3CIISLog
| where csUriStem has_any (suspiciousPaths) or sPort in (mcpPorts)
| extend AuthHeader = tostring(parse_json(tostring(customFields)).Authorization)
| where csMethod in ("POST", "GET")
| where isnotempty(AuthHeader) and AuthHeader startswith "Bearer "
| extend Token = trim_start("Bearer ", AuthHeader)
// Legitimate Atlassian OAuth tokens are JWTs (3 dot-separated segments) or long opaque tokens; short/random tokens indicate a bypass attempt
| where strlen(Token) < 40 or Token !contains "."
| project TimeGenerated, cIP, sIP, sPort, csMethod, csUriStem, Token, scStatus, csUserAgent
| summarize RequestCount = count(), Tokens = make_set(Token, 20), StatusCodes = make_set(scStatus, 10) by cIP, csUriStem, csUserAgent, bin(TimeGenerated, 1h)
| where RequestCount > 0

index=web (uri_path="/mcp" OR uri_path="/sse" OR uri_path="/messages" OR dest_port IN (8000,9000))
| eval auth=coalesce('header.Authorization', authorization_header)
| where isnotnull(auth) AND like(auth, "Bearer %")
| eval token=replace(auth, "^Bearer\s+", "")
| eval token_len=len(token)
| eval segments=mvcount(split(token, "."))
| where token_len < 40 OR segments < 3
| stats count AS req_count values(token) AS tokens values(status) AS statuses dc(token) AS distinct_tokens by src_ip uri_path http_user_agent
| where req_count > 0

network where destination.port in (8000, 9000) and
  (url.path : "/mcp*" or url.path : "/sse*" or url.path : "/messages*") and
  http.request.method in ("POST", "GET") and
  http.request.headers.authorization : "Bearer *" and
  (length(http.request.headers.authorization) < 47 or
   not http.request.headers.authorization : "Bearer *.*.*")

SELECT sourceip, destinationip, destinationport, "URL", "HTTP Method", "User Agent", COUNT(*) AS req_count
FROM events
WHERE ("URL" ILIKE '%/mcp%' OR "URL" ILIKE '%/sse%' OR "URL" ILIKE '%/messages%' OR destinationport IN (8000, 9000))
  AND "Authorization Header" ILIKE 'Bearer %'
  AND (LENGTH("Authorization Header") < 47 OR "Authorization Header" NOT ILIKE 'Bearer %.%.%')
GROUP BY sourceip, destinationip, destinationport, "URL", "HTTP Method", "User Agent"
LAST 24 HOURS

_sourceCategory=web/access ("/mcp" OR "/sse" OR "/messages")
| parse regex "(?<method>\w+)\s+(?<uri>\S+)\s+HTTP" nodrop
| parse regex "[Aa]uthorization:\s*Bearer\s+(?<token>\S+)" nodrop
| where !isBlank(token)
| length(token) as token_len
| if (token matches "*.*.*", 1, 0) as is_jwt
| where token_len < 40 or is_jwt = 0
| count as req_count, values(token) by src_ip, uri, user_agent
| where req_count > 0

rule mcp_atlassian_auth_bypass_CVE_2026_77244 {
  meta:
    author = "Argus"
    description = "Detects arbitrary bearer tokens accepted by vulnerable mcp-atlassian HTTP transport"
    cve = "CVE-2026-77244"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (re.regex($e.network.http.request_uri, `/mcp|/sse|/messages`) or $e.principal.port = 8000 or $e.principal.port = 9000)
    re.regex($e.network.http.request_header_authorization, `^Bearer\s+\S+`)
    not re.regex($e.network.http.request_header_authorization, `^Bearer\s+[^.]+\.[^.]+\.[^.]+$`)
    $src = $e.principal.ip
  match:
    $src over 1h
  condition:
    $e
}

#event_simpleName=/HttpRequest/i
| in(field="RemotePort", values=["8000", "9000"]) OR RequestUrl=/\/(mcp|sse|messages)/i
| AuthorizationHeader=/^Bearer\s+(?<token>\S+)/i
| token_len := length("token")
| case {
    token=/^[^.]+\.[^.]+\.[^.]+$/ | is_jwt := "1";
    * | is_jwt := "0";
  }
| test(token_len < 40) OR is_jwt = "0"
| groupBy([aid, RemoteAddressIP4, RequestUrl], function=count(as=req_count))