CVE-2026-77267: mcp-atlassian has an incomplete SSRF remediation
Summary
The UserTokenMiddleware extracts URLs from X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers and passes them directly to API client constructors without any SSRF validation.
Affected Package
- Ecosystem: PyPI - Package: mcp-atlassian - Affected versions: all versions before fix commit 5cd697dfce91 - Patched versions: >= commit 5cd697dfce91
Details
In main.py, processauthenticationheaders() extracts URLs from ASGI headers without validation. In dependencies.py, getjirafetcher() creates JiraConfig with url=jiraurlheader directly. There is no validateurl call, no IP range check, no hostname validation.
The fix adds URL validation to some paths but the header-based URL extraction in processauthenticationheaders() still passes raw URLs through. The derived config objects use the header URL directly and the fetcher makes HTTP requests to that URL.
PoC
python jiraurlheader = headers.get(b"x-atlassian-jira-url") jiraurlstr = jiraurlheader.decode("latin-1") if jiraurlheader else None serviceheaders["X-Atlassian-Jira-Url"] = jiraurlstr
Steps to reproduce: 1. git clone https://github.com/sooperset/mcp-atlassian /tmp/mcp-atlassiantest 2. cd /tmp/mcp-atlassiantest && git checkout 5cd697dfce91~1 3. pip install -e . 4. python3 poc.py
Expected output: VULNERABILITY CONFIRMED User-supplied URLs from HTTP headers passed directly to JiraConfig/JiraFetcher with no SSRF validation
Impact
An attacker can set X-Atlassian-Jira-Url: http://169.254.169.254/latest/meta-data/ to access AWS instance metadata, or target any internal service. The server makes authenticated HTTP requests to the attacker-specified URL.
Suggested Remediation
Validate all user-supplied URLs against an allowlist of permitted hostnames or reject private/loopback/link-local IP ranges. Consider requiring server-side configuration of allowed Atlassian instance URLs.
Other sources
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by processauthenticationheaders and used to construct Atlassian fetchers without calling validateurlforssrf. A caller who can set these headers can supply an internal or metadata-service URL and cause the server to send requests to that destination, bypassing the incomplete CVE-2026-27826 remediation. This issue is fixed in version 0.22.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/mcp-atlassianto a version that resolves this vulnerability.Fixed in 0.22.0 - Upgrade
Upgrade
mcp-atlassianto a version that resolves this vulnerability.Fixed in 0.22.0 - Configuration
Require server-side configuration of permitted Atlassian instance URLs and validate all user-supplied header URLs against that allowlist; alternatively reject private, loopback, and link-local IP ranges.
mcp-atlassian allowed Atlassian instance URLs = allowlist of permitted hostnames
Event History
Frequently Asked Questions
Which deployments are exposed?
MCP Atlassian deployments running versions before 0.22.0 are affected if a caller can supply the X-Atlassian-Jira-Url or X-Atlassian-Confluence-Url headers.
What access does an attacker need to exploit this issue?
The attacker needs the ability to send requests to the MCP server with attacker-controlled Atlassian URL headers. They can then provide an internal-service or metadata-service URL as a header value.
What is the impact of successful exploitation?
The server can be induced to make requests to an attacker-selected internal or metadata-service destination. The vulnerable header-processing path constructs Atlassian fetchers without SSRF URL validation.
What version fixes the issue?
Version 0.22.0 fixes this issue.