GHSA-489g-7rxv-6c8q: MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)
The mcp-atlassian package contains a time-of-check to time-of-use (TOCTOU) vulnerability in its SSRF protection mechanism. The vulnerability arises because the SSRF validation resolves and validates the hostname once at middleware time but does not pin the resolved IP address. The actual outbound request re-resolves the hostname at connect time without IP pinning, allowing an attacker-controlled DNS rebinding to bypass the SSRF fix. This can lead to unauthenticated SSRF to internal or cloud metadata services. The vulnerability affects versions prior to 0.22.0. A proof-of-concept demonstrates the structural bypass, though a live exploit requires a DNS rebinding attacker. The severity is high but not critical due to the rebinding race condition precondition.
AI Analysis
Technical Summary
This vulnerability is a TOCTOU bypass of the SSRF fix in mcp-atlassian (CVE-2026-27826). The original fix added a middleware-time DNS resolution and validation of the X-Atlassian-Url headers but only returned a validation verdict without pinning the resolved IP. The actual HTTP request later re-resolves the raw hostname at connect time without IP pinning, allowing an attacker-controlled DNS name to return a public IP during validation and an internal or cloud metadata IP during connection. This enables an unauthenticated SSRF to internal services despite the patch. The vulnerability is confirmed by a proof-of-concept that simulates the two DNS resolutions and demonstrates the TOCTOU bypass. The vulnerability affects code in src/mcp_atlassian/utils/urls.py, servers/main.py, and servers/dependencies.py, and impacts versions before 0.22.0. The recommended remediation is to pin the connection to the validated IP by using a custom resolver or cached DNS adapter to prevent re-resolution at connect time.
Potential Impact
An attacker can exploit this vulnerability to perform unauthenticated server-side request forgery (SSRF) attacks against internal or cloud metadata services by leveraging DNS rebinding. This can lead to unauthorized reading of sensitive internal resources such as cloud metadata IAM credentials or internal services. The vulnerability bypasses the existing SSRF mitigation in patched versions by exploiting the lack of IP pinning between validation and connection. The impact severity is high, with potential confidentiality loss but limited integrity or availability impact.
Mitigation Recommendations
No official patch is currently available. The recommended mitigation is to modify the code to pin the connection to the IP address validated by validate_url_for_ssrf. This can be achieved by using a custom DNS resolver or a cached getaddrinfo adapter in the HTTP client to prevent re-resolution of the hostname at connect time. Alternatively, passing the validated IP with a Host header can mitigate the issue. Users should monitor the vendor advisory for updates and patches addressing this TOCTOU DNS rebinding bypass.
GHSA-489g-7rxv-6c8q: MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)
Description
The mcp-atlassian package contains a time-of-check to time-of-use (TOCTOU) vulnerability in its SSRF protection mechanism. The vulnerability arises because the SSRF validation resolves and validates the hostname once at middleware time but does not pin the resolved IP address. The actual outbound request re-resolves the hostname at connect time without IP pinning, allowing an attacker-controlled DNS rebinding to bypass the SSRF fix. This can lead to unauthenticated SSRF to internal or cloud metadata services. The vulnerability affects versions prior to 0.22.0. A proof-of-concept demonstrates the structural bypass, though a live exploit requires a DNS rebinding attacker. The severity is high but not critical due to the rebinding race condition precondition.
CVSS v3.1
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability is a TOCTOU bypass of the SSRF fix in mcp-atlassian (CVE-2026-27826). The original fix added a middleware-time DNS resolution and validation of the X-Atlassian-Url headers but only returned a validation verdict without pinning the resolved IP. The actual HTTP request later re-resolves the raw hostname at connect time without IP pinning, allowing an attacker-controlled DNS name to return a public IP during validation and an internal or cloud metadata IP during connection. This enables an unauthenticated SSRF to internal services despite the patch. The vulnerability is confirmed by a proof-of-concept that simulates the two DNS resolutions and demonstrates the TOCTOU bypass. The vulnerability affects code in src/mcp_atlassian/utils/urls.py, servers/main.py, and servers/dependencies.py, and impacts versions before 0.22.0. The recommended remediation is to pin the connection to the validated IP by using a custom resolver or cached DNS adapter to prevent re-resolution at connect time.
Potential Impact
An attacker can exploit this vulnerability to perform unauthenticated server-side request forgery (SSRF) attacks against internal or cloud metadata services by leveraging DNS rebinding. This can lead to unauthorized reading of sensitive internal resources such as cloud metadata IAM credentials or internal services. The vulnerability bypasses the existing SSRF mitigation in patched versions by exploiting the lack of IP pinning between validation and connection. The impact severity is high, with potential confidentiality loss but limited integrity or availability impact.
Mitigation Recommendations
No official patch is currently available. The recommended mitigation is to modify the code to pin the connection to the IP address validated by validate_url_for_ssrf. This can be achieved by using a custom DNS resolver or a cached getaddrinfo adapter in the HTTP client to prevent re-resolution of the hostname at connect time. Alternatively, passing the validated IP with a Host header can mitigate the issue. Users should monitor the vendor advisory for updates and patches addressing this TOCTOU DNS rebinding bypass.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-489g-7rxv-6c8q
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a520ec968715ace438f5ef2
Added to database: 07/11/2026, 09:37:13 UTC
Last enriched: 07/11/2026, 09:57:10 UTC
Last updated: 07/11/2026, 21:41:24 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.