EUVD-2026-54953
GHSA-rmrp-j9qh-xwh9
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and low privilege match the description; scope changed because SSRF reaches internal network resources beyond the vulnerable system; no integrity or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in KS-GEN-AI jira-mcp-server 0.2.0. This affects the function axios.get of the file src/index.ts of the component add_attachment_from_public_url. The manipulation of the argument imageUrl results in server-side request forgery. The attack requires a local approach. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in KS-GEN-AI jira-mcp-server 0.2.0 allows a local low-privileged attacker to make the server issue arbitrary HTTP requests by manipulating the imageUrl argument passed to axios.get within the add_attachment_from_public_url function. The CVSS 4.0 vector (AV:L/PR:L/E:P) confirms local access is required, low privileges suffice, and proof-of-concept code exists. No vendor patch has been released; the project maintainer had not responded to the responsible disclosure issue at time of analysis.
Technical ContextAI
The affected component is the add_attachment_from_public_url MCP tool handler in src/index.ts of the jira-mcp-server project (CPE: cpe:2.3:a:ks-gen-ai:jira-mcp-server:*:*:*:*:*:*:*:*). The server is a Model Context Protocol (MCP) integration that connects AI assistants to Atlassian Jira. The vulnerable code path uses the axios.get HTTP client to fetch an image from a caller-supplied imageUrl without validating or restricting the target URL. CWE-918 (Server-Side Request Forgery) describes this root cause class: the application uses externally-supplied data as part of an outbound HTTP request without sanitizing the destination, enabling an attacker to redirect server-originated requests to unintended internal or external targets.
RemediationAI
No vendor-released patch has been identified at time of analysis; the project maintainer had not responded to the GitHub issue report (https://github.com/KS-GEN-AI/jira-mcp-server/issues/6). As an immediate compensating control, restrict the runtime environment of jira-mcp-server so it has no network path to sensitive internal services - place it in a network namespace or container with egress rules that block access to cloud metadata endpoints (e.g., 169.254.169.254) and internal RFC-1918 ranges. This limits the blast radius of a successful SSRF. Additionally, restrict which local users or AI assistant processes can invoke the add_attachment_from_public_url MCP tool. Organizations may also consider patching the source directly by adding URL allowlist validation in src/index.ts before the axios.get call, then building from the patched source. Monitor the GitHub repository for an official fix and upgrade once a patched release is tagged.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today