CVE-2026-77267: mcp-atlassian incomplete SSRF remediation in URL header processing

CVE-2026-77267 · Severity: high · CVSS 4 · Published 2026-09-22

mcp-atlassian is a PyPI package that integrates with Atlassian services (Jira and Confluence). The package fails to properly validate URLs provided via HTTP headers before making authenticated server-to-server requests, allowing an attacker to redirect those requests to internal services—such as AWS metadata endpoints or other private systems—potentially exposing sensitive configuration data or enabling lateral movement within a network.

Technologies: mcp-atlassian (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-77267 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77267 being exploited in the wild.
How severe is CVE-2026-77267?
High severity, with a CVSS score of 4, published 22 September 2026.
Which products and versions are affected?
mcp-atlassian (PyPI) < 0.22.0, ECOSYSTEM:introduced=0,fixed=0.22.0.
Is there a fix for CVE-2026-77267?
Yes. mcp-atlassian (PyPI): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77267 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-77267?
Check whether you run mcp-atlassian (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp-atlassian (PyPI): upgrade to 0.22.0 or later
    pip install "mcp-atlassian>=0.22.0"

Technical details

The vulnerability is an incomplete Server-Side Request Forgery (SSRF) remediation in the UserTokenMiddleware component. The `_process_authentication_headers()` function in main.py extracts URLs from the `X-Atlassian-Jira-Url` and `X-Atlassian-Confluence-Url` HTTP headers and passes them directly to JiraConfig/ConfluenceConfig constructors without any SSRF validation (no IP range checks, no hostname allowlist, no loopback/link-local filtering). The fetcher then makes authenticated HTTP requests to these attacker-controlled URLs. The attack vector is network-based and does not require authentication; an attacker sends a crafted HTTP request with a malicious header value. A prior fix attempted to add URL validation to some code paths but did not cover the header-extraction pathway. Attackers can exploit this to access AWS instance metadata (e.g., http://169.254.169.254/latest/meta-data/) or internal services, potentially exfiltrating credentials or configuration data.

Affected products

  • mcp-atlassian mcp-atlassian all versions before commit 5cd697dfce91

Identifiers

  • CVE-2026-77267
  • GHSA-5wf4-jqxh-8gm3
  • PYSEC-2026-4084

Timeline

  • 2026-09-22: disclosed
  • advisory: GHSA-5wf4-jqxh-8gm3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.