Executive brief
The Atlassian Model Context Protocol (MCP) server validates URLs in HTTP headers for security before making requests, but an attacker can exploit DNS rebinding to bypass this check. By rapidly changing DNS records between validation and actual request execution, an attacker can redirect requests to internal cloud metadata services or internal network resources, potentially stealing credentials and accessing sensitive data.
Technical details
This is a classic time-of-check-time-of-use (TOCTOU) vulnerability in the SSRF protection mechanism. The validate_url_for_ssrf function in urls.py performs a DNS lookup and verifies the resolved IP is globally routable; however, the HTTP request using the requests library happens later in dependencies.py with a separate DNS resolution. An attacker can register a domain with a short TTL that initially resolves to a legitimate public IP (passing validation), then immediately changes the DNS record to resolve to an internal IP like 169.254.169.254 (AWS metadata service) before the HTTP request is made. The SSRF redirect hook only validates redirect Location headers, not the initial connection target, leaving the initial DNS resolution unprotected. The vulnerability requires multiple attempts (probabilistic exploitation) and currently only affects deployments using the header_pat authentication branch.
Affected products
- Atlassian MCP Atlassian Server
Timeline
- 2026-09-22: disclosed