Executive brief
MCP Atlassian is a connector used by Claude to integrate with Jira and other Atlassian products. A security control designed to prevent server-side request forgery (SSRF) attacks is missing from the basic authentication and OAuth credential paths, even though it correctly protects the API token path. An attacker who compromises an Atlassian server can redirect requests from the MCP connector to internal cloud services—such as AWS metadata endpoints—to steal credentials or access internal infrastructure.
Technical details
The vulnerability is an incomplete fix for a prior SSRF issue (GHSA-7r34-79r5-rcc9). The `_make_ssrf_safe_hook()` function validates HTTP `Location` headers in 3xx redirects and blocks requests to private IP addresses. However, this hook is only attached when using header-based PAT authentication; basic auth and OAuth authentication branches call `_create_and_validate()` without the `attach_ssrf_hook=True` parameter, leaving those codepaths unprotected. An attacker controlling or compromising an Atlassian server can return a 302 redirect to a private address (e.g., 169.254.169.254 AWS metadata, internal Kubernetes API, or database) and the unhooked session will follow it, exfiltrating credentials or internal data. The fix is straightforward: add `attach_ssrf_hook=True` to the two affected `_create_and_validate()` calls in the basic auth and OAuth branches.
Affected products
- Anthropic MCP Atlassian 0.21.1 and earlier
Timeline
- 2026-09-22: disclosed: GHSA-6529-c226-h328 published