CVE-2026-77265: MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow
Summary
The SSRF protection for header-based authentication uses a validate-then-use pattern vulnerable to DNS rebinding. validateurlforssrf resolves the hostname via DNS and checks that the resolved IP is globally routable. However, the actual HTTP request happens later, during which the DNS record may have changed to point to an internal IP (127.0.0.1, 169.254.169.254, etc.). The SSRF redirect hook only validates redirect targets, not the initial connection.
Details
The vulnerability spans main.py (validation) and dependencies.py (use).
Step 1 -- URL validation at middleware time:
In src/mcpatlassian/servers/main.py:524-531, the URL from X-Atlassian-Jira-Url is validated:
if jiraurlstr: ssrferror = validateurlforssrf(jiraurlstr) if ssrferror: # blocked
validateurlforssrf (src/mcpatlassian/utils/urls.py:113-116) resolves DNS and checks isglobal:
dnserror = checkdnsresolution(hostname) if dnserror: return dnserror
Step 2 -- HTTP request happens later with a separate DNS resolution:
In src/mcpatlassian/servers/dependencies.py:544-562, a JiraFetcher is created with the attacker URL and makes HTTP requests to it. The SSRF redirect hook (attachssrfhook=True) is applied but only checks redirect Location headers, not the initial connection target.
DNS rebinding timeline:
1. Attacker sets up rebind.attacker.com with short TTL (1 second) 2. First DNS resolution (validateurlforssrf): returns 1.2.3.4 (public) -- passes 3. TTL expires 4. Second DNS resolution (requests.get): returns 169.254.169.254 (metadata) 5. HTTP request reaches internal IP, bypassing the SSRF check
PoC
Use a DNS rebinding service like rbndr.us. Send a request with X-Atlassian-Jira-Url set to a rebinding hostname (e.g., rebind-169.254.169.254-1.2.3.4.rbndr.us) and X-Atlassian-Jira-Personal-Token set to any value. With approximately 50% probability per attempt, the request reaches the internal metadata service.
Impact
- Cloud metadata access: Steal IAM credentials via 169.254.169.254 - Internal network scanning: Proxy requests to internal services - AC:H: DNS rebinding is probabilistic and requires multiple attempts - Limited to headerpat branch: Only affects deployments accepting header-based PAT authentication
Recommended Fix
Pin DNS resolution: resolve the hostname once during validation, then connect to the resolved IP directly (with the original hostname in the Host header). This eliminates the TOCTOU gap between validation and use.
Other sources
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, header-supplied Jira or Confluence URLs are resolved and validated before the HTTP client resolves the hostname again for the connection. An unauthenticated caller can use a DNS-rebinding hostname that returns a public address during validation and an internal address during connection, causing requests to internal or metadata services. The advisory traces the vulnerable input and processing flow through X-Atlassian-Jira-Url, X-Atlassian-Confluence-Url, validateurlforssrf, and DNS rebinding, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/mcp-atlassianto a version that resolves this vulnerability.Fixed in 0.22.0 - Upgrade
Upgrade
MCP Atlassianto a version that resolves this vulnerability.Fixed in 0.22.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated caller can exploit the issue if they can send requests that supply the X-Atlassian-Jira-Url or X-Atlassian-Confluence-Url headers to an affected MCP Atlassian server.
What does an attacker need to control?
The attacker needs a DNS-rebinding hostname that resolves to a public address during URL validation and then to an internal address when the HTTP client connects. This can cause the server to issue requests to internal or metadata services.
Which deployments are affected?
MCP Atlassian versions before 0.22.0 are affected where the header-based Jira or Confluence URL flow is reachable. The vulnerable processing path includes the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url inputs.
How can I determine whether my deployment is affected?
Check the deployed MCP Atlassian version. Versions earlier than 0.22.0 are affected; version 0.22.0 contains the fix.