EUVD-2026-77799Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Server-side request forgery in the MCP Atlassian MCP server (versions 0.17.0 through 0.21.x) allows remote unauthenticated attackers to force the server to make outbound requests to internal addresses such as the cloud metadata endpoint 169.254.169.254. The flaw is an incomplete-fix TOCTOU: validate_url_for_ssrf resolves and approves the attacker-supplied X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url host once at middleware time, but the actual HTTP client re-resolves the raw hostname at connect time with no IP pinning, so a DNS-rebinding name can pass validation with a public IP and then resolve to a link-local or RFC1918 address. Exploitation is a documented, publicly described proof-of-concept rather than confirmed in-the-wild activity (no CISA KEV listing), and the vendor has released version 0.22.0 as the fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Mcp Atlassian gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). From 0.17.0 until 0.22.0, validate_url_for_ssrf resolves the attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url header host once at middleware time, but the outbound request is built with the raw hostname and resolves it again at connection time with no IP pinning. An attacker-controlled DNS-rebinding name can return a public IP during validation and 169.254.169.254 or another internal IP during connection, enabling unauthenticated server-side requests to cloud metadata or internal services. The flaw spans src/mcp_atlassian/utils/urls.py, src/mcp_atlassian/servers/main.py, and src/mcp_atlassian/servers/dependencies.py; validate_url_for_ssrf returns only a verdict rather than a pinned IP, UserTokenMiddleware processes the attacker-controlled headers before fetcher creation, and the Jira and Confluence fetchers use the raw hostname. This issue is fixed in version 0.22.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
More in Mcp Atlassian
View allServer-side request forgery in MCP Atlassian (the Model Context Protocol server for Confluence and Jira) prior to 0.22.0
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 applies its ENABLED_TOOLS and TOOLSETS least-privilege filters onl
Path traversal in MCP Atlassian releases prior to 0.22.0 lets a caller of the confluence_upload_attachment MCP tool read
Unauthenticated arbitrary file read in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 lets a remote network calle
Arbitrary local file read leading to data exfiltration affects sooperset's MCP Atlassian server (mcp-atlassian) prior to
Unauthenticated server-local file exfiltration in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows a remote
Server-side request forgery in MCP Atlassian prior to 0.22.0 lets an attacker who controls or has already compromised th
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 lets a low-privileged authenticated MCP caller write attacker-chos
Server-side request forgery in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows a low-privileged authenticat
Arbitrary local file read in MCP Atlassian (mcp-atlassian) prior to 0.22.0 allows an authenticated MCP caller who can re
Arbitrary server-local file read and exfiltration in MCP Atlassian (sooperset/mcp-atlassian) prior to 0.22.0 lets an aut
Path traversal in the MCP Atlassian server (mcp-atlassian) prior to 0.22.0 allows an authenticated MCP client to read fi
Exploit-DB