Executive brief
MCP Atlassian is a Model Context Protocol server that integrates with Confluence and Jira for task automation. A flaw in SSRF (Server-Side Request Forgery) protection allows attackers to bypass validation checks by exploiting DNS rebinding—using a domain that resolves to a public address during validation but a private/internal address during actual connection. An attacker can gain unauthenticated access to internal endpoints and metadata services that should be protected.
Technical details
The validate_url_for_ssrf function resolves hostnames during validation but the underlying Requests and urllib3 libraries perform a second DNS resolution at connection time. An attacker can exploit this time-of-check-time-of-use (TOCTOU) window by serving a short-lived DNS answer that is public during validation and private during connection. The vulnerability affects the SSRF validation logic in _check_dns_resolution and _make_ssrf_safe_hook entry points. Version 0.22.0 fixes this by introducing SsrfPinningAdapter, which resolves each host exactly once and pins the connection to the validated address.
Affected products
- sooperset mcp-atlassian before 0.22.0
Timeline
- 2026-09-22: disclosed