CVE-2026-77265 — MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow

Affected: sooperset mcp-atlassian

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, header-supplied Jira or Confluence URLs are resolved and validated before the HTTP client resolves the hostname again for the connection. An unauthenticated caller can use a DNS-rebinding hostname that returns a public address during validation and an internal address during connection, causing requests to internal or metadata services. The advisory traces the vulnerable input and processing flow through X-Atlassian-Jira-Url, X-Atlassian-Confluence-Url, validate_url_for_ssrf, and DNS rebinding, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

GHSA-49xv-9743-pw8w — MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow

Affected: PyPI: mcp-atlassian

## Summary

The SSRF protection for header-based authentication uses a validate-then-use pattern vulnerable to DNS rebinding. validate_url_for_ssrf resolves the hostname via DNS and checks that the resolved IP is globally routable. However, the actual HTTP request happens later, during which the DNS record may have changed to point to an internal IP (127.0.0.1, 169.254.169.254, etc.). The SSRF redirect hook only validates redirect targets, not the initial connection.

## Details

The vulnerability spans main.py (validation) and dependencies.py (use).

**Step 1 -- URL validation at middleware time:**

In src/mcp_atlassian/servers/main.py:524-531, the URL from X-Atlassian-Jira-Url is validated:

if jira_url_str: ssrf_error = validate_url_for_ssrf(jira_url_str) if ssrf_error: # blocked

validate_url_for_ssrf (src/mcp_atlassian/utils/urls.py:113-116) resolves DNS and checks is_global:

dns_error = _check_dns_resolution(hostname) if dns_error: return dns_error

**Step 2 -- HTTP request happens later with a separate DNS resolution:**

In src/mcp_atlassian/servers/dependencies.py:544-562, a JiraFetcher is created with the attacker URL and makes HTTP requests to it. The SSRF redirect hook (attach_ssrf_hook=True) is applied but only checks redirect Location headers, not the initial connection target.

**DNS rebinding timeline:**

1. Attacker sets up rebind.attacker.com with short TTL (1 second) 2. First DNS resolution (validate_url_for_…

Most recent entries from all

CVE-2026-77265 — MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow

GHSA-49xv-9743-pw8w — MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow