CVE-2026-77249: MCP Atlassian SSRF Vulnerability

CVE-2026-77249 Overview

CVE-2026-77249 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in MCP Atlassian, a Model Context Protocol (MCP) server for Atlassian products including Confluence and Jira. Versions prior to 0.22.0 contain a flaw in JiraUserMixin._lookup_user_by_permissions that uses the module-level requests.get function instead of the fetcher's protected session. This bypass allows a caller-controlled public Jira URL to redirect the request to an internal address, defeating the redirect checks introduced for CVE-2026-27826. The issue is fixed in version 0.22.0.

Critical Impact
A network attacker with no privileges can coerce the MCP Atlassian server into issuing HTTP requests to internal network resources, potentially exposing metadata services or internal APIs.

Affected Products

MCP Atlassian (Model Context Protocol server for Atlassian)
Versions prior to 0.22.0
Deployments integrating Jira Cloud or Jira Data Center through MCP Atlassian

Discovery Timeline

2026-09-22 - CVE-2026-77249 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77249

Vulnerability Analysis

The vulnerability resides in the JiraUserMixin._lookup_user_by_permissions method inside MCP Atlassian. The function performs an HTTP lookup by invoking the module-level requests.get function directly, rather than routing through the fetcher's protected session that enforces SSRF safety controls. Because the request skips self.jira._session.get and its associated _make_ssrf_safe_hook, the SSRF-safe redirect validation added in the fix for CVE-2026-27826 does not run. An attacker who controls the Jira URL supplied to the MCP server can therefore host a redirect chain that steers the request toward internal addresses such as cloud metadata endpoints or private-network services.

Root Cause

The root cause is inconsistent use of the hardened HTTP session. The security controls for outbound requests are attached to the fetcher's session object through _make_ssrf_safe_hook. Calling the module-level requests.get bypasses that hook, leaving the code path unprotected. This is a classic incomplete-mitigation pattern where a follow-on code path escaped the initial SSRF fix.

Attack Vector

Exploitation requires the attacker to influence the public Jira URL that MCP Atlassian queries. The attacker's endpoint returns an HTTP redirect (3xx) pointing to an internal target such as http://169.254.169.254/ or an internal service. Because requests.get follows redirects by default and no SSRF hook is applied, the server issues the internal request and may return response content or side-channel information to the caller. The CVSS vector AV:N/AC:L/PR:N/UI:N reflects unauthenticated network exploitation with confidentiality impact.

See the GitHub Security Advisory GHSA-v9m3-wfh8-5646 and the GitHub Pull Request #1448 for the vulnerable code paths and remediation details.

Detection Methods for CVE-2026-77249

Indicators of Compromise

Outbound HTTP requests from the MCP Atlassian host to link-local addresses such as 169.254.169.254 or RFC1918 ranges shortly after a Jira user lookup.
MCP Atlassian access logs showing user lookup operations against attacker-controlled Jira base URLs.
Unexpected redirect responses (301, 302, 307) recorded by the MCP Atlassian process to non-Atlassian hostnames.

Detection Strategies

Inspect outbound traffic from the MCP Atlassian process for connections that leave the expected Atlassian API destinations.
Correlate Jira URL configuration changes with subsequent internal-network access from the MCP host.
Review installed MCP Atlassian versions against the fixed release 0.22.0 published on the GitHub Release v0.22.0 page.

Monitoring Recommendations

Enable egress logging on hosts running MCP Atlassian and alert on non-approved destinations.
Instrument Python requests traffic with a proxy or DNS sink to observe redirect chains during user lookups.
Monitor cloud metadata endpoint access from any workload that hosts MCP servers.

How to Mitigate CVE-2026-77249

Immediate Actions Required

Upgrade MCP Atlassian to version 0.22.0 or later, which routes _lookup_user_by_permissions through the SSRF-safe session.
Restrict configuration of the Jira base URL to trusted operators and validate it against an allowlist of approved Atlassian domains.
Deploy the MCP Atlassian process in a network segment without access to cloud metadata services or sensitive internal APIs.

Patch Information

The fix is included in MCP Atlassian 0.22.0. The corrective changes are documented in the GitHub Commit Details and GitHub Pull Request #1448. The patch replaces the direct requests.get call with the fetcher's protected session so _make_ssrf_safe_hook validates every redirect target.

Workarounds

Front the MCP Atlassian outbound traffic with an egress proxy that blocks link-local and private IP ranges.
Enforce IMDSv2 or disable instance metadata access on cloud hosts running MCP Atlassian.
Terminate the process's ability to reach internal management networks using host-based firewall rules until the upgrade is applied.

bash

# Configuration example: upgrade MCP Atlassian to the patched release
pip install --upgrade "mcp-atlassian>=0.22.0"

# Verify installed version
python -c "import importlib.metadata; print(importlib.metadata.version('mcp-atlassian'))"