The vulnerability in the MCP Atlassian server allows an unauthenticated attacker to trigger outbound HTTP requests to any URL by supplying unvalidated X-Atlassian-Jira-Url or X-Atlassian-Confluence-Url headers. Because no Authorization header is required, the flaw permits remote control of outgoing traffic from the host. The flaw can be used for internal network reconnaissance, to exfiltrate data via the instance metadata service, or to inject attacker‑controlled content into LLM tool results. The flaw resides in the HTTP middleware and dependency injection layer, making it invisible to typical tool‐level code analysis.

The affected product is the MCP Atlassian server, part of the sooperset project. Any version prior to 0.17.0 that exposes the mcp-atlassian HTTP endpoint is vulnerable. The server acts as a Model Context Protocol (MCP) endpoint for Atlassian Confluence and Jira services.

According to the CVSS score of 8.2, this is a high‑severity vulnerability. The EPSS score of less than 1% indicates that exploitation is currently rare, and the flaw is not listed in the CISA KEV catalogue. Nonetheless, because the flaw is unauthenticated, an attacker with network access to the server can exploit it immediately. The potential impact includes internal network discovery, credential theft via the instance metadata endpoint, and malicious injection into LLM tool outputs. The risk is elevated in cloud or complex network environments where the server can reach internal services that it should not access.