The MCP Atlassian server, a Model Context Protocol endpoint for Atlassian products, contains a Server Side Request Forgery flaw (CWE‑918). An attacker who can reach the open HTTP endpoint can supply custom X‑Atlassian‑Jira‑Url and X‑Atlassian‑Confluence‑Url headers without any Authorization token; the server blindly follows these headers and initiates outbound HTTP requests to the supplied URLs. This allows arbitrary outbound traffic, enabling internal network discovery, potential theft of IAM role credentials through the instance‑metadata service on cloud hosts, and injection of attacker‑controlled content into LLM tool responses. No authentication is required, making the vulnerability immediately exploitable by any host that can reach the endpoint. Affected systems are all releases of the MCP Atlassian server distributed by SooperSet before version 0.17.0. The flaw exists in the HTTP middleware and dependency injection layer, not within the application logic, so it may go unnoticed by code‑analysis tools that focus on higher‑level handlers.

All releases of the MCP Atlassian server distributed by SooperSet before version 0.17.0 are affected.

Risk and exploitability are high. The CVSS score of 8.2 indicates high severity, and the EPSS score of 15% reflects a moderate to high likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalogue, but because it requires no authentication and accepts arbitrary user input in headers, any host that can reach the exposed HTTP endpoint presents a viable attack vector for internal reconnaissance, credential theft, or manipulation of LLM outputs.