The vulnerability is a Server‑Side Request Forgery caused by DNS rebinding in the header‑based authentication flow of MCP Atlassian. An unauthenticated caller can supply a specially crafted DNS‑rebinding hostname in the X‑Atlassian‑Jira‑Url or X‑Atlassian‑Confluence‑Url header, which the server first validates using the hostname’s public address and then later resolves to an internal address for the HTTP connection. This allows the attacker to force the MCP server to issue network requests to internal or metadata services, potentially leaking sensitive data or enabling further exploitation. This flaw is classified as a CWE-918 Server‑Side Request Forgery.

The affected product is MCP Atlassian, a Model Context Protocol server used with Atlassian Confluence and Jira. Versions prior to 0.22.0 are vulnerable. The issue originates from processing of the header fields X‑Atlassian‑Jira‑Url and X‑Atlassian‑Confluence‑Url.

The recorded CVSS score of 5.9 indicates a moderate risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of known exploitation in the wild is currently unclear. Attackers need only be able to send unauthenticated HTTP requests with the vulnerable headers; therefore remote exploitation is possible over any network path that can reach the MCP service. If exploited, the attacker could read or manipulate internal services accessed by the MCP server.