GHSA-49XV-9743-PW8W
Vulnerability from github – Published: 2026-09-22 20:35 – Updated: 2026-09-22 20:35Summary
The SSRF protection for header-based authentication uses a validate-then-use pattern vulnerable to DNS rebinding. validate_url_for_ssrf resolves the hostname via DNS and checks that the resolved IP is globally routable. However, the actual HTTP request happens later, during which the DNS record may have changed to point to an internal IP (127.0.0.1, 169.254.169.254, etc.). The SSRF redirect hook only validates redirect targets, not the initial connection.
Details
The vulnerability spans main.py (validation) and dependencies.py (use).
Step 1 -- URL validation at middleware time:
In src/mcp_atlassian/servers/main.py:524-531, the URL from X-Atlassian-Jira-Url is validated:
if jira_url_str:
ssrf_error = validate_url_for_ssrf(jira_url_str)
if ssrf_error:
# blocked
validate_url_for_ssrf (src/mcp_atlassian/utils/urls.py:113-116) resolves DNS and checks is_global:
dns_error = _check_dns_resolution(hostname)
if dns_error:
return dns_error
Step 2 -- HTTP request happens later with a separate DNS resolution:
In src/mcp_atlassian/servers/dependencies.py:544-562, a JiraFetcher is created with the attacker URL and makes HTTP requests to it. The SSRF redirect hook (attach_ssrf_hook=True) is applied but only checks redirect Location headers, not the initial connection target.
DNS rebinding timeline:
- Attacker sets up rebind.attacker.com with short TTL (1 second)
- First DNS resolution (validate_url_for_ssrf): returns 1.2.3.4 (public) -- passes
- TTL expires
- Second DNS resolution (requests.get): returns 169.254.169.254 (metadata)
- HTTP request reaches internal IP, bypassing the SSRF check
PoC
Use a DNS rebinding service like rbndr.us. Send a request with X-Atlassian-Jira-Url set to a rebinding hostname (e.g., rebind-169.254.169.254-1.2.3.4.rbndr.us) and X-Atlassian-Jira-Personal-Token set to any value. With approximately 50% probability per attempt, the request reaches the internal metadata service.
Impact
- Cloud metadata access: Steal IAM credentials via 169.254.169.254
- Internal network scanning: Proxy requests to internal services
- AC:H: DNS rebinding is probabilistic and requires multiple attempts
- Limited to header_pat branch: Only affects deployments accepting header-based PAT authentication
Recommended Fix
Pin DNS resolution: resolve the hostname once during validation, then connect to the resolved IP directly (with the original hostname in the Host header). This eliminates the TOCTOU gap between validation and use.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mcp-atlassian"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.22.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-77265"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-22T20:35:08Z",
"nvd_published_at": "2026-09-22T18:17:18Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nThe SSRF protection for header-based authentication uses a validate-then-use pattern vulnerable to DNS rebinding. validate_url_for_ssrf resolves the hostname via DNS and checks that the resolved IP is globally routable. However, the actual HTTP request happens later, during which the DNS record may have changed to point to an internal IP (127.0.0.1, 169.254.169.254, etc.). The SSRF redirect hook only validates redirect targets, not the initial connection.\n\n## Details\n\nThe vulnerability spans main.py (validation) and dependencies.py (use).\n\n**Step 1 -- URL validation at middleware time:**\n\nIn src/mcp_atlassian/servers/main.py:524-531, the URL from X-Atlassian-Jira-Url is validated:\n\n if jira_url_str:\n ssrf_error = validate_url_for_ssrf(jira_url_str)\n if ssrf_error:\n # blocked\n\nvalidate_url_for_ssrf (src/mcp_atlassian/utils/urls.py:113-116) resolves DNS and checks is_global:\n\n dns_error = _check_dns_resolution(hostname)\n if dns_error:\n return dns_error\n\n**Step 2 -- HTTP request happens later with a separate DNS resolution:**\n\nIn src/mcp_atlassian/servers/dependencies.py:544-562, a JiraFetcher is created with the attacker URL and makes HTTP requests to it. The SSRF redirect hook (attach_ssrf_hook=True) is applied but only checks redirect Location headers, not the initial connection target.\n\n**DNS rebinding timeline:**\n\n1. Attacker sets up rebind.attacker.com with short TTL (1 second)\n2. First DNS resolution (validate_url_for_ssrf): returns 1.2.3.4 (public) -- passes\n3. TTL expires\n4. Second DNS resolution (requests.get): returns 169.254.169.254 (metadata)\n5. HTTP request reaches internal IP, bypassing the SSRF check\n\n## PoC\n\nUse a DNS rebinding service like rbndr.us. Send a request with X-Atlassian-Jira-Url set to a rebinding hostname (e.g., rebind-169.254.169.254-1.2.3.4.rbndr.us) and X-Atlassian-Jira-Personal-Token set to any value. With approximately 50% probability per attempt, the request reaches the internal metadata service.\n\n## Impact\n\n- **Cloud metadata access**: Steal IAM credentials via 169.254.169.254\n- **Internal network scanning**: Proxy requests to internal services\n- **AC:H**: DNS rebinding is probabilistic and requires multiple attempts\n- **Limited to header_pat branch**: Only affects deployments accepting header-based PAT authentication\n\n## Recommended Fix\n\nPin DNS resolution: resolve the hostname once during validation, then connect to the resolved IP directly (with the original hostname in the Host header). This eliminates the TOCTOU gap between validation and use.",
"id": "GHSA-49xv-9743-pw8w",
"modified": "2026-09-22T20:35:08Z",
"published": "2026-09-22T20:35:08Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-49xv-9743-pw8w"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77265"
},
{
"type": "WEB",
"url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
},
{
"type": "WEB",
"url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
},
{
"type": "PACKAGE",
"url": "https://github.com/sooperset/mcp-atlassian"
},
{
"type": "WEB",
"url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.