CVE-2026-77265: MCP Atlassian SSRF Vulnerability

CVE-2026-77265 Overview

CVE-2026-77265 is a Server-Side Request Forgery (SSRF) vulnerability in MCP Atlassian, a Model Context Protocol (MCP) server for Atlassian Confluence and Jira. Prior to version 0.22.0, header-supplied Jira or Confluence URLs are validated before the HTTP client resolves the hostname a second time for the actual connection. An unauthenticated caller can exploit this Time-of-Check to Time-of-Use (TOCTOU) gap using DNS rebinding to redirect requests to internal or cloud metadata services. The vulnerable flow involves the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers processed by the validate_url_for_ssrf control. The issue is fixed in version 0.22.0.

Critical Impact
Unauthenticated attackers can access internal network resources and cloud metadata endpoints by tricking the MCP server into connecting to attacker-controlled destinations.

Affected Products

MCP Atlassian versions prior to 0.22.0
Deployments exposing the MCP server over the network
Environments accepting the X-Atlassian-Jira-Url or X-Atlassian-Confluence-Url headers

Discovery Timeline

2026-09-22 - CVE-2026-77265 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77265

Vulnerability Analysis

The vulnerability is classified as SSRF (CWE-918) and stems from a DNS rebinding race between validation and connection. The MCP Atlassian server accepts caller-supplied Atlassian instance URLs via the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers. When a request arrives, the validate_url_for_ssrf function resolves the hostname and confirms that it points to a permitted public address. The HTTP client then performs a second, independent DNS resolution when initiating the outbound connection. An attacker who controls an authoritative DNS server can serve a public IP during validation and an internal IP (such as 127.0.0.1, RFC1918 space, or 169.254.169.254) during the connection phase.

Root Cause

The root cause is the double DNS resolution pattern between the SSRF validator and the HTTP client. Because validation results are not pinned to a specific IP address for reuse during connection, the low-TTL rebinding attack succeeds. This defeats hostname-based allowlisting and any check performed on resolved addresses at validation time.

Attack Vector

Exploitation requires an unauthenticated network request to the MCP Atlassian endpoint. The attacker configures a domain returning short-TTL DNS responses, alternating between a public IP and an internal target. The attacker then submits a request with the malicious hostname in the X-Atlassian-Jira-Url or X-Atlassian-Confluence-Url header, causing the server to issue requests to internal services or cloud instance metadata endpoints.

No synthetic exploitation code is provided. See the GitHub Security Advisory GHSA-49xv-9743-pw8w and Pull Request #1448 for the vulnerable code paths and patch details.

Detection Methods for CVE-2026-77265

Indicators of Compromise

Inbound HTTP requests to the MCP Atlassian server containing X-Atlassian-Jira-Url or X-Atlassian-Confluence-Url headers referencing untrusted domains.
Outbound connections from the MCP Atlassian process to RFC1918 ranges, loopback addresses, or cloud metadata IPs such as 169.254.169.254.
DNS queries from the MCP host resolving to alternating public and private addresses within short intervals.

Detection Strategies

Monitor MCP Atlassian access logs for header values pointing to non-corporate Atlassian domains.
Alert on any egress traffic from the MCP service to internal network segments or link-local metadata endpoints.
Inspect DNS resolver logs for hostnames with unusually low TTL values that resolve to both public and internal addresses.

Monitoring Recommendations

Enable network egress logging on the host running MCP Atlassian and forward events to a centralized analytics pipeline.
Correlate MCP request logs with outbound HTTP destinations to identify TOCTOU rebinding patterns.
Track version metadata for MCP Atlassian deployments to confirm patched builds are running.

How to Mitigate CVE-2026-77265

Immediate Actions Required

Upgrade MCP Atlassian to version 0.22.0 or later, which contains the SSRF hardening fix.
Restrict inbound access to the MCP Atlassian server to trusted networks and authenticated clients only.
Block outbound access from the MCP host to internal ranges and cloud metadata endpoints where not required.

Patch Information

The fix is available in MCP Atlassian v0.22.0. See commit b0417334 for the security hardening changes covering SSRF, attachment handling, transport, authorization, and filtering.

Workarounds

Deny the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers at an upstream reverse proxy until patching is complete.
Enforce an egress firewall policy blocking the MCP host from reaching RFC1918, loopback, and 169.254.169.254 destinations.
Configure the resolver or HTTP client to enforce a minimum DNS TTL and pin resolved addresses across validation and connection.

bash

# Example egress restriction using iptables to block metadata and internal targets
iptables -A OUTPUT -m owner --uid-owner mcp-atlassian -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp-atlassian -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp-atlassian -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp-atlassian -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp-atlassian -d 127.0.0.0/8 -j REJECT