CVE-2026-73497
MediumCVSS 6.5Summary
In MCP Atlassian from 0.17.0 until 0.22.0, validate_url_for_ssrf resolves the attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url header host once at middleware time, but the outbound request uses the raw hostname and resolves it again without IP pinning. This enables DNS-rebinding attacks and unauthenticated requests to cloud metadata or internal services.
Risk Assessment
An unauthenticated attacker can access internal services or cloud metadata (e.g., 169.254.169.254), potentially leading to leakage of credentials or privilege escalation.
Recommendation
Upgrade MCP Atlassian to version 0.22.0, which contains the fix resolving this vulnerability.
Other vulnerabilities in MCP Atlassian
See all- CVE-2026-73496High
MCP Atlassian before 0.22.0 allows a client with write-tool access to pass file paths without confinement to the server, leading to disclosure of server files, Atlassian credentials, or another tenant's data.
- CVE-2026-73498High
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment passes its client-supplied file_path directly to open(file_path, "rb") in src/mcp_atlassian/confluence/attachments.py through _upload_attachment_direct() without calling validate_safe_path. An authenticated MCP client can read any file accessible to the server process and exfiltrate it to Confluence as an attachment. If an AI agent can be induced to call the tool through untrusted content, the same flaw can disclose server environment variables such as CONFLUENCE_API_TOKEN and other credentials. This issue is fixed in version 0.22.0.
Original NVD description (English source)
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). From 0.17.0 until 0.22.0, validate_url_for_ssrf resolves the attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url header host once at middleware time, but the outbound request is built with the raw hostname and resolves it again at connection time with no IP pinning. An attacker-controlled DNS-rebinding name can return a public IP during validation and 169.254.169.254 or another internal IP during connection, enabling unauthenticated server-side requests to cloud metadata or internal services. The flaw spans src/mcp_atlassian/utils/urls.py, src/mcp_atlassian/servers/main.py, and src/mcp_atlassian/servers/dependencies.py; validate_url_for_ssrf returns only a verdict rather than a pinned IP, UserTokenMiddleware processes the attacker-controlled headers before fetcher creation, and the Jira and Confluence fetchers use the raw hostname. This issue is fixed in version 0.22.0.