CVE-2026-19369 Overview
CVE-2026-19369 is a server-side request forgery (SSRF) vulnerability in KS-GEN-AI jira-mcp-server version 0.2.0. The flaw resides in the add_attachment_from_public_url component, specifically within the axios.get call in src/index.ts. An attacker with local access can manipulate the imageUrl argument to coerce the server into issuing arbitrary HTTP requests to attacker-chosen destinations. The project maintainers were notified through a public issue report but have not responded as of publication. This vulnerability is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
An authenticated local attacker can abuse the Model Context Protocol (MCP) server to fetch attacker-controlled URLs, enabling reconnaissance against internal services accessible to the host process.
Affected Products
- KS-GEN-AI jira-mcp-server version 0.2.0
- The vulnerable function axios.get in src/index.ts
- The add_attachment_from_public_url MCP tool component
Discovery Timeline
- 2026-08-09 - CVE-2026-19369 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-19369
Vulnerability Analysis
The jira-mcp-server project implements a Model Context Protocol server that exposes Jira operations to AI clients. One of its tools, add_attachment_from_public_url, accepts a caller-supplied imageUrl and uses axios.get to fetch remote content before forwarding it to Jira as an attachment. The handler does not validate the scheme, hostname, or resolved IP address of imageUrl before dispatching the request.
An attacker who can invoke this tool can therefore direct the server to request internal endpoints, cloud metadata services, or localhost-bound administrative interfaces. The response body or timing signal can be used to enumerate internal infrastructure reachable from the MCP host. Because MCP tools are typically invoked by an LLM acting on user instructions, prompt injection reaching the model provides an additional path to reach this sink.
Root Cause
The root cause is missing validation of user-controlled URLs before an outbound HTTP request. The axios.get(imageUrl) invocation trusts the incoming argument without enforcing an allowlist of hosts, blocking private address ranges, or disabling redirects to internal destinations.
Attack Vector
Exploitation requires a local approach with low privileges and no user interaction. An attacker who can send tool invocations to the running MCP server supplies an imageUrl such as http://127.0.0.1:<port>/ or http://169.254.169.254/latest/meta-data/ and observes the server's behavior. See the GitHub Issue #6 Discussion for community-reported technical details.
Because verified proof-of-concept code is not published, the mechanism is described in prose. Refer to the GitHub Repository for Jira MCP and the VulDB CVE-2026-19369 Entry for additional technical context.
Detection Methods for CVE-2026-19369
Indicators of Compromise
- Outbound HTTP requests from the jira-mcp-server process to RFC1918 addresses, 127.0.0.0/8, or cloud metadata endpoints such as 169.254.169.254.
- Tool invocation logs showing add_attachment_from_public_url calls with imageUrl values pointing to non-public hosts.
- Unexpected process network activity originating from the Node.js runtime hosting src/index.ts.
Detection Strategies
- Instrument the MCP server to log the imageUrl argument and the resolved destination IP for every add_attachment_from_public_url invocation.
- Alert on any DNS resolution from the server process that returns a private, loopback, or link-local address.
- Correlate MCP tool telemetry with egress firewall logs to identify requests that bypass expected Jira Cloud destinations.
Monitoring Recommendations
- Forward MCP server logs and host network telemetry to a centralized data lake for retrospective SSRF hunting.
- Baseline the normal set of destination hostnames contacted by the jira-mcp-server process and alert on deviations.
- Monitor prompt inputs supplied to the connected LLM for URL patterns targeting internal ranges, since prompt injection can trigger the sink.
How to Mitigate CVE-2026-19369
Immediate Actions Required
- Restrict access to the local MCP server socket so only trusted LLM clients on the host can invoke tools.
- Disable or remove the add_attachment_from_public_url tool until the maintainer publishes a fix.
- Run the server as an unprivileged user in a network namespace that cannot reach internal management interfaces or cloud metadata services.
Patch Information
No vendor patch has been released. The maintainers were notified through GitHub Issue #6 but have not responded. Track the GitHub Repository for Jira MCP for future releases beyond version 0.2.0.
Workarounds
- Wrap axios.get with an allowlist that permits only expected image hosting domains and rejects private, loopback, and link-local IP ranges after DNS resolution.
- Disable HTTP redirects on the axios client to prevent bypass via redirect chains to internal targets.
- Deploy egress filtering that blocks the MCP server host from reaching 169.254.169.254, 127.0.0.0/8, and RFC1918 ranges except where explicitly required.
# Example egress restriction using iptables for the MCP server user
iptables -A OUTPUT -m owner --uid-owner mcp -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp -d 127.0.0.0/8 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
