Technical impact
The MCP Atlassian server, a Model Context Protocol endpoint for Atlassian products, contains a Server Side Request Forgery flaw (CWE‑918). An unauthenticated attacker who can reach the open HTTP endpoint can supply custom X‑Atlassian‑Jira‑Url and X‑Atlassian‑Confluence‑Url headers without any Authorization token; the server blindly follows these headers and initiates outbound HTTP requests to the supplied URLs. This allows arbitrary outbound traffic, enabling internal network discovery, potential theft of IAM role credentials through the instance‑metadata service on cloud hosts, and injection of attacker‑controlled content into LLM tool responses.
Affected Systems
All releases of the MCP Atlassian server distributed by SooperSet before version 0.17.0 are affected.
Risk and Exploitability
Risk and exploitability are high. The CVSS score of 8.2 indicates high severity, and the EPSS score of 14% indicates a higher likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalogue, but because it requires no authentication and accepts arbitrary user input in headers, any host that can reach the exposed HTTP endpoint presents a viable attack vector for internal reconnaissance, credential theft, or manipulation of LLM outputs.
Github GHSA