Is CVE-2026-77242 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77242 being exploited in the wild.

How severe is CVE-2026-77242?

High severity, with a CVSS score of 7.5, published 22 September 2026.

Which products and versions are affected?

Sooperset Mcp-Atlassian before 0.22.0.

Is there a fix for CVE-2026-77242?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-77242 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-77242?

Check whether you run Sooperset Mcp-Atlassian at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77242: MCP Atlassian SSRF validation bypass via DNS rebinding

CVE-2026-77242 · Severity: high · CVSS 7.5 · Published 2026-09-22

MCP Atlassian is a Model Context Protocol server that integrates with Confluence and Jira for task automation. A flaw in SSRF (Server-Side Request Forgery) protection allows attackers to bypass validation checks by exploiting DNS rebinding—using a domain that resolves to a public address during validation but a private/internal address during actual connection. An attacker can gain unauthenticated access to internal endpoints and metadata services that should be protected.

Technologies: Sooperset Mcp-Atlassian. Vendors: Sooperset.

Quick answers

Is CVE-2026-77242 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77242 being exploited in the wild.
How severe is CVE-2026-77242?: High severity, with a CVSS score of 7.5, published 22 September 2026.
Which products and versions are affected?: Sooperset Mcp-Atlassian before 0.22.0.
Is there a fix for CVE-2026-77242?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-77242 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-77242?: Check whether you run Sooperset Mcp-Atlassian at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The validate_url_for_ssrf function resolves hostnames during validation but the underlying Requests and urllib3 libraries perform a second DNS resolution at connection time. An attacker can exploit this time-of-check-time-of-use (TOCTOU) window by serving a short-lived DNS answer that is public during validation and private during connection. The vulnerability affects the SSRF validation logic in _check_dns_resolution and _make_ssrf_safe_hook entry points. Version 0.22.0 fixes this by introducing SsrfPinningAdapter, which resolves each host exactly once and pins the connection to the validated address.

Affected products

sooperset mcp-atlassian before 0.22.0

Timeline

2026-09-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.