CVE-2026-77261: MCP Atlassian SSRF Vulnerability

CVE-2026-77261 Overview

CVE-2026-77261 is a Server-Side Request Forgery (SSRF) vulnerability in MCP Atlassian, a Model Context Protocol server for Confluence and Jira. The flaw exists in versions prior to 0.22.0. The _make_ssrf_safe_hook guard is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauth_pat code branches. An attacker-controlled or compromised Atlassian instance can return a redirect pointing at an internal address. The unhardened sessions follow that redirect without revalidating the destination, allowing requests to reach internal network resources. The issue is classified under [CWE-918].

Critical Impact
Attackers can pivot MCP Atlassian sessions into internal networks by returning crafted HTTP redirects from a controlled Atlassian endpoint.

Affected Products

MCP Atlassian versions prior to 0.22.0
Deployments using basic-auth authentication branches
Deployments using oauth_pat (OAuth Personal Access Token) authentication branches

Discovery Timeline

2026-09-22 - CVE-2026-77261 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77261

Vulnerability Analysis

MCP Atlassian brokers requests between Model Context Protocol clients and Atlassian products. It builds authenticated HTTP sessions using JiraFetcher and ConfluenceFetcher. A defensive hook named _make_ssrf_safe_hook normally inspects redirect targets before the session follows them. In vulnerable versions, this hook is not attached to sessions created through the basic-auth and oauth_pat initialization paths. A compromised or attacker-controlled Atlassian instance can respond with an HTTP 3xx redirect pointing to an internal-only address, such as a cloud metadata endpoint or an internal admin service. The MCP Atlassian session honors the redirect, issuing an authenticated request to the internal target.

Root Cause

The root cause is inconsistent application of the SSRF-safe redirect hook across authentication branches. The hardened OAuth flow attaches _make_ssrf_safe_hook, but the basic-auth and oauth_pat flows construct sessions without the hook. This creates a missing security control [CWE-918] specific to redirect validation.

Attack Vector

Exploitation requires an attacker to control or compromise the Atlassian instance that MCP Atlassian connects to, or to influence its configured URL. The attacker configures the malicious endpoint to return a redirect to an internal resource. When the MCP server makes an outbound Jira or Confluence request, the session follows the redirect and returns internal response data to the attacker's original endpoint context. The scope-changed impact enables reads against services otherwise unreachable from the network perimeter.

python

# Patch context from the security hardening commit
# Confine the upload source to the workspace before it is read: reject
# traversal/absolute paths that escape CWD (arbitrary file read /
# exfiltration via a caller-supplied file_path).
file_path = str(validate_safe_path(file_path))

# Check if file exists
if not os.path.exists(file_path):

Source: GitHub Commit b0417334

Detection Methods for CVE-2026-77261

Indicators of Compromise

Outbound HTTP requests from MCP Atlassian hosts to RFC1918 addresses, 127.0.0.1, or cloud metadata endpoints such as 169.254.169.254.
Unexpected HTTP 3xx responses from the configured Atlassian base URL followed by internal-address requests in proxy logs.
MCP Atlassian process activity correlating with authentication tokens accessing non-Atlassian internal services.

Detection Strategies

Inventory MCP Atlassian deployments and identify versions below 0.22.0 running basic-auth or oauth_pat authentication.
Inspect egress proxy and firewall logs for redirect chains originating from Atlassian hostnames terminating at internal IP ranges.
Alert on any DNS resolutions from MCP Atlassian hosts that return private or link-local addresses for external hostnames.

Monitoring Recommendations

Enforce egress filtering that blocks MCP Atlassian hosts from reaching internal subnets and cloud metadata IPs.
Log full URL redirect chains at the proxy layer to reconstruct SSRF attempts.
Monitor GitHub advisory feeds for the GHSA-6529-c226-h328 record for downstream updates.

How to Mitigate CVE-2026-77261

Immediate Actions Required

Upgrade MCP Atlassian to version 0.22.0 or later, which attaches _make_ssrf_safe_hook to all session initialization paths.
Audit configured Atlassian base URLs and rotate any credentials that were used with unpatched MCP Atlassian instances.
Restrict MCP Atlassian outbound network access to the Atlassian tenant hostnames only.

Patch Information

The fix is delivered in MCP Atlassian v0.22.0 via Pull Request #1448 and commit b0417334. The patch applies the SSRF-safe redirect hook uniformly across JiraFetcher and ConfluenceFetcher sessions built through the basic-auth and oauth_pat branches.

Workarounds

Place MCP Atlassian behind an egress proxy that rejects redirects to private or link-local address ranges.
Use only trusted, verified Atlassian instance URLs in MCP Atlassian configuration and prevent runtime modification.
Where feasible, migrate to the OAuth flow that already attached the SSRF-safe hook before upgrading.

bash

# Upgrade MCP Atlassian to the patched release
pip install --upgrade "mcp-atlassian>=0.22.0"

# Verify installed version
pip show mcp-atlassian | grep -i version