CVE-2026-77274: Atlassian MCP SSRF protection bypass via URL parser mismatch

CVE-2026-77274 · Severity: high · CVSS 4 · Published 2026-09-22

The MCP Atlassian connector is used to integrate Atlassian cloud services (Jira, Confluence) with AI applications. An attacker who controls the Jira or Confluence URL parameter can bypass internal network protections and force the server to make requests to local services or internal infrastructure, potentially exposing sensitive data or disrupting operations.

Technologies: mcp-atlassian (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-77274 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77274 being exploited in the wild.
How severe is CVE-2026-77274?
High severity, with a CVSS score of 4, published 22 September 2026.
Which products and versions are affected?
mcp-atlassian (PyPI) < 0.22.0, ECOSYSTEM:introduced=0,fixed=0.22.0.
Is there a fix for CVE-2026-77274?
Yes. mcp-atlassian (PyPI): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77274 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-77274?
Check whether you run mcp-atlassian (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp-atlassian (PyPI): upgrade to 0.22.0 or later
    pip install "mcp-atlassian>=0.22.0"

Technical details

The vulnerability is a parser mismatch in SSRF validation. The `validate_url_for_ssrf()` function uses Python's `urllib.parse.urlparse()` to extract the hostname for security checks, but a URL containing a backslash in the userinfo portion (e.g., `http://127.0.0.1:6666\@www.baidu.com`) causes `urlparse()` to incorrectly parse the hostname as `www.baidu.com`. The downstream HTTP client library `requests` interprets the same URL differently, routing the actual request to `127.0.0.1:6666` with the backslash percent-encoded in the path. This allows an attacker to supply a malicious Jira or Confluence URL via the `X-Atlassian-Jira-Url` or `X-Atlassian-Confluence-Url` headers to bypass SSRF protection and target loopback or internal services. No authentication bypass is required; an attacker need only control the URL header. A fix would require consistent URL parsing between validation and request execution.

Affected products

  • Atlassian MCP Atlassian 2.14.5

Identifiers

  • CVE-2026-77274
  • GHSA-hgcf-4mq8-5266
  • PYSEC-2026-4096

Timeline

  • 2026-09-22: disclosed: Vulnerability published on GitHub
  • 2026: other: CVE-2026-77274 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.