The vulnerability arises from an incomplete defense against DNS rebinding in the MCP Atlassian validation logic. During URL formulation, the server resolves a hostname to IP addresses, but when establishing the outbound connection, the DNS lookup is repeated using the Requests and urllib3 libraries. An attacker can supply a hostname that resolves to a public IP during validation but to a private or internal IP at connection time. This allows the attacker to reach internal services or cloud metadata endpoints without authentication, effectively bypassing the previous SSRF mitigation. The weakness is rooted in improper handling of DNS responses, reflected in CWE‑367 and CWE‑918, and can undermine confidentiality, integrity, and availability of the server.

The issue affects the sooperset MCP Atlassian server deployed to support Atlassian products such as Confluence and Jira. Versions prior to 0.22.0 are vulnerable. The fix is available in release 0.22.0, which corrects the validation path so that the hostname is resolved only once and no re-resolution occurs during the connection phase.

The CVSS score of 7.5 indicates a high severity on the vulnerability scoring system. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a DNS rebinding attack, where an attacker who can control the DNS records for a chosen hostname initiates a request from a legitimate client to the MCP Atlassian server. The attacker does not need privileged credentials locally; the vulnerability payload is delivered via the URL supplied to the service. Exploitation requires that the server be reachable from the attacker’s network and that the attacker can manipulate DNS responses for the chosen hostname while the client initiates the validation request.