Executive brief
mcp-atlassian is a PyPI package that integrates with Atlassian services (Jira and Confluence). The package fails to properly validate URLs provided via HTTP headers before making authenticated server-to-server requests, allowing an attacker to redirect those requests to internal services—such as AWS metadata endpoints or other private systems—potentially exposing sensitive configuration data or enabling lateral movement within a network.
Technical details
The vulnerability is an incomplete Server-Side Request Forgery (SSRF) remediation in the UserTokenMiddleware component. The `_process_authentication_headers()` function in main.py extracts URLs from the `X-Atlassian-Jira-Url` and `X-Atlassian-Confluence-Url` HTTP headers and passes them directly to JiraConfig/ConfluenceConfig constructors without any SSRF validation (no IP range checks, no hostname allowlist, no loopback/link-local filtering). The fetcher then makes authenticated HTTP requests to these attacker-controlled URLs. The attack vector is network-based and does not require authentication; an attacker sends a crafted HTTP request with a malicious header value. A prior fix attempted to add URL validation to some code paths but did not cover the header-extraction pathway. Attackers can exploit this to access AWS instance metadata (e.g., http://169.254.169.254/latest/meta-data/) or internal services, potentially exfiltrating credentials or configuration data.
Affected products
- mcp-atlassian mcp-atlassian all versions before commit 5cd697dfce91
Timeline
- 2026-09-22: disclosed
- advisory: GHSA-5wf4-jqxh-8gm3