CVE-2026-77265

MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow

View on CVE.org
Published Sep 22, 2026 CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Description
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, header-supplied Jira or Confluence URLs are resolved and validated before the HTTP client resolves the hostname again for the connection. An unauthenticated caller can use a DNS-rebinding hostname that returns a public address during validation and an internal address during connection, causing requests to internal or metadata services. The advisory traces the vulnerable input and processing flow through X-Atlassian-Jira-Url, X-Atlassian-Confluence-Url, validate_url_for_ssrf, and DNS rebinding, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Analysis

AI-generated

Technical impact

The vulnerability is a Server‑Side Request Forgery caused by DNS rebinding in the header‑based authentication flow of MCP Atlassian. An unauthenticated caller can supply a specially crafted DNS‑rebinding hostname in the X‑Atlassian‑Jira‑Url or X‑Atlassian‑Confluence‑Url header, which the server first validates using the hostname’s public address and then later resolves to an internal address for the HTTP connection. This allows the attacker to force the MCP server to issue network requests to internal or metadata services, potentially leaking sensitive data or enabling further exploitation. This flaw is classified as a CWE-918 Server‑Side Request Forgery.

Affected Systems

The affected product is MCP Atlassian, a Model Context Protocol server used with Atlassian Confluence and Jira. Versions prior to 0.22.0 are vulnerable. The issue originates from processing of the header fields X‑Atlassian‑Jira‑Url and X‑Atlassian‑Confluence‑Url.

Risk and Exploitability

The recorded CVSS score of 5.9 indicates a moderate risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of known exploitation in the wild is currently unclear. Attackers need only be able to send unauthenticated HTTP requests with the vulnerable headers; therefore remote exploitation is possible over any network path that can reach the MCP service. If exploited, the attacker could read or manipulate internal services accessed by the MCP server.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade MCP Atlassian to version 0.22.0 or later.
  • If an upgrade is not possible, block or restrict the X‑Atlassian‑Jira‑Url and X‑Atlassian‑Confluence‑Url headers from untrusted clients, or enforce stricter hostname validation that rejects DNS‑rebinding patterns.
  • Protect internal services that may be called via SSRF by limiting their accessibility from the MCP server or configuring a firewall to deny inbound connections from externally reachable endpoints.

Generated by OpenCVE AI on September 22, 2026 at 20:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-49xv-9743-pw8w MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow
History
Type Values Removed Values Added
First Time appeared Mcp-atlassian
Mcp-atlassian mcp Atlassian
CPEs cpe:2.3:a:mcp-atlassian:mcp_atlassian:*:*:*:*:*:*:*:*
Vendors & Products Mcp-atlassian
Mcp-atlassian mcp Atlassian
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Sooperset
Sooperset mcp-atlassian
Vendors & Products Sooperset
Sooperset mcp-atlassian
Type Values Removed Values Added
Description MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, header-supplied Jira or Confluence URLs are resolved and validated before the HTTP client resolves the hostname again for the connection. An unauthenticated caller can use a DNS-rebinding hostname that returns a public address during validation and an internal address during connection, causing requests to internal or metadata services. The advisory traces the vulnerable input and processing flow through X-Atlassian-Jira-Url, X-Atlassian-Confluence-Url, validate_url_for_ssrf, and DNS rebinding, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
Title MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}
Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Sep 28, 2026, 5:46 PM
Reserved
Aug 20, 2026, 7:14 PM

View source JSON

Updated
Sep 28, 2026, 5:46 PM

JSON

Status
Analyzed
Published
Sep 22, 2026, 6:17 PM
Modified
Sep 29, 2026, 7:00 PM

View source JSON

No data.

Updated
Sep 22, 2026, 8:15 PM

JSON