{"data":{"id":"2c144915-0fe1-495b-b92f-5dbe3cfe0f7a","title":"GHSA-7r34-79r5-rcc9: MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers","summary":"mcp-atlassian's HTTP middleware and dependency layer accept an unvalidated X-Atlassian-Jira-Url (and the Confluence equivalent) from unauthenticated requests when no Authorization header is present. The server then issues an outbound GET to {header_url}/rest/api/2/myself, enabling server-side request forgery, which the advisory says can expose IAM credentials via 169.254.169.254 in cloud deployments and enable internal network reconnaissance and injection of attacker-controlled content into LLM tool results.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-7r34-79r5-rcc9","publishedAt":"2026-03-10T18:48:46.000Z","cveId":"CVE-2026-27826","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mcp-atlassian@< 0.17.0 (fixed: 0.17.0)"],"affectedPackageNames":["mcp-atlassian"],"affectedPackageRefs":["pypi:mcp-atlassian"],"affectedVendors":[],"affectedVendorsRaw":["MCP Atlassian","Jira","Confluence"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.13,"epssCheckedAt":"2026-11-04T00:12:27.710Z","kevDateAdded":null,"advisoryAliases":["GHSA-7r34-79r5-rcc9"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-03-10T18:48:46.000Z","fixReleasedAt":"2026-02-24T11:56:33.114Z","daysToFix":-14,"fixCheckedAt":"2026-10-29T21:40:00.810Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"mcp-atlassian","fixedVersion":"0.17.0","matchedVersion":"0.17.0","fixReleasedAt":"2026-02-24T11:56:33.114Z","daysToFix":-14,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:00.664Z"}]}}