CVE-2026-19369
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In KS-GEN-AI jira-mcp-server 0.2.0, a vulnerability was found in the axios.get function of src/index.ts (add_attachment_from_public_url component). Manipulation of the imageUrl argument leads to server-side request forgery (SSRF). The attack requires local access.
Risk Assessment
SSRF vulnerability may allow an attacker to access internal resources, potentially leading to system security compromise.
Recommendation
It is recommended to validate and sanitize the imageUrl argument and restrict access to the add_attachment_from_public_url function.
Original NVD description (English source)
A vulnerability was found in KS-GEN-AI jira-mcp-server 0.2.0. This affects the function axios.get of the file src/index.ts of the component add_attachment_from_public_url. The manipulation of the argument imageUrl results in server-side request forgery. The attack requires a local approach. The project was informed of the problem early through an issue report but has not responded yet.