CVE-2026-73497: CWE-918: Server-Side Request Forgery (SSRF) in sooperset mcp-atlassian
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). From 0.17.0 until 0.22.0, validate_url_for_ssrf resolves the attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url header host once at middleware time, but the outbound request is built with the raw hostname and resolves it again at connection time with no IP pinning. An attacker-controlled DNS-rebinding name can return a public IP during validation and 169.254.169.254 or another internal IP during connection, enabling unauthenticated server-side requests to cloud metadata or internal services. The flaw spans src/mcp_atlassian/utils/urls.py, src/mcp_atlassian/servers/main.py, and src/mcp_atlassian/servers/dependencies.py; validate_url_for_ssrf returns only a verdict rather than a pinned IP, UserTokenMiddleware processes the attacker-controlled headers before fetcher creation, and the Jira and Confluence fetchers use the raw hostname. This issue is fixed in version 0.22.0.
AI Analysis
Technical Summary
The vulnerability in sooperset mcp-atlassian (versions >=0.17.0 <0.22.0) involves the validate_url_for_ssrf function resolving attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers only once during middleware processing. However, the outbound request uses the raw hostname and performs a second DNS resolution at connection time without IP pinning. This discrepancy allows an attacker to use DNS rebinding to bypass validation by returning a public IP during validation and an internal IP (such as 169.254.169.254) during connection, enabling SSRF attacks to internal or cloud metadata services. The flaw spans multiple source files and is fixed in version 0.22.0.
Potential Impact
An unauthenticated attacker can exploit this SSRF vulnerability to make the server send requests to internal or cloud metadata services that are normally inaccessible. This can lead to exposure of sensitive information such as cloud instance metadata or internal network resources. The CVSS score of 6.5 (medium severity) reflects high confidentiality impact with limited integrity impact and no availability impact.
Mitigation Recommendations
Upgrade to sooperset mcp-atlassian version 0.22.0 or later, where this SSRF vulnerability is fixed. No other mitigations are specified. Patch status is confirmed fixed in 0.22.0.
CVE-2026-73497: CWE-918: Server-Side Request Forgery (SSRF) in sooperset mcp-atlassian
Description
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). From 0.17.0 until 0.22.0, validate_url_for_ssrf resolves the attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url header host once at middleware time, but the outbound request is built with the raw hostname and resolves it again at connection time with no IP pinning. An attacker-controlled DNS-rebinding name can return a public IP during validation and 169.254.169.254 or another internal IP during connection, enabling unauthenticated server-side requests to cloud metadata or internal services. The flaw spans src/mcp_atlassian/utils/urls.py, src/mcp_atlassian/servers/main.py, and src/mcp_atlassian/servers/dependencies.py; validate_url_for_ssrf returns only a verdict rather than a pinned IP, UserTokenMiddleware processes the attacker-controlled headers before fetcher creation, and the Jira and Confluence fetchers use the raw hostname. This issue is fixed in version 0.22.0.
CVSS v3.1
Score 6.5medium
Affected software
sooperset
mcp-atlassian
pkg:github/sooperset/mcp-atlassianRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in sooperset mcp-atlassian (versions >=0.17.0 <0.22.0) involves the validate_url_for_ssrf function resolving attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers only once during middleware processing. However, the outbound request uses the raw hostname and performs a second DNS resolution at connection time without IP pinning. This discrepancy allows an attacker to use DNS rebinding to bypass validation by returning a public IP during validation and an internal IP (such as 169.254.169.254) during connection, enabling SSRF attacks to internal or cloud metadata services. The flaw spans multiple source files and is fixed in version 0.22.0.
Potential Impact
An unauthenticated attacker can exploit this SSRF vulnerability to make the server send requests to internal or cloud metadata services that are normally inaccessible. This can lead to exposure of sensitive information such as cloud instance metadata or internal network resources. The CVSS score of 6.5 (medium severity) reflects high confidentiality impact with limited integrity impact and no availability impact.
Mitigation Recommendations
Upgrade to sooperset mcp-atlassian version 0.22.0 or later, where this SSRF vulnerability is fixed. No other mitigations are specified. Patch status is confirmed fixed in 0.22.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-12T19:00:33.736Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa852d855bf5e2cf58935a5
Added to database: 09/14/2026, 20:02:32 UTC
Last enriched: 09/14/2026, 20:17:17 UTC
Last updated: 09/15/2026, 03:10:53 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.