Executive brief
The MCP Atlassian connector is used to integrate Atlassian cloud services (Jira, Confluence) with AI applications. An attacker who controls the Jira or Confluence URL parameter can bypass internal network protections and force the server to make requests to local services or internal infrastructure, potentially exposing sensitive data or disrupting operations.
Technical details
The vulnerability is a parser mismatch in SSRF validation. The `validate_url_for_ssrf()` function uses Python's `urllib.parse.urlparse()` to extract the hostname for security checks, but a URL containing a backslash in the userinfo portion (e.g., `http://127.0.0.1:6666\@www.baidu.com`) causes `urlparse()` to incorrectly parse the hostname as `www.baidu.com`. The downstream HTTP client library `requests` interprets the same URL differently, routing the actual request to `127.0.0.1:6666` with the backslash percent-encoded in the path. This allows an attacker to supply a malicious Jira or Confluence URL via the `X-Atlassian-Jira-Url` or `X-Atlassian-Confluence-Url` headers to bypass SSRF protection and target loopback or internal services. No authentication bypass is required; an attacker need only control the URL header. A fix would require consistent URL parsing between validation and request execution.
Affected products
- Atlassian MCP Atlassian 2.14.5
Timeline
- 2026-09-22: disclosed: Vulnerability published on GitHub
- 2026: other: CVE-2026-77274 assigned