CVE-2026-77267 — mcp-atlassian has an incomplete SSRF remediation

Affected: sooperset mcp-atlassian

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by _process_authentication_headers and used to construct Atlassian fetchers without calling validate_url_for_ssrf. A caller who can set these headers can supply an internal or metadata-service URL and cause the server to send requests to that destination, bypassing the incomplete CVE-2026-27826 remediation. This issue is fixed in version 0.22.0.

GHSA-5wf4-jqxh-8gm3 — mcp-atlassian has an incomplete SSRF remediation

Affected: PyPI: mcp-atlassian

### Summary

The `UserTokenMiddleware` extracts URLs from `X-Atlassian-Jira-Url` and `X-Atlassian-Confluence-Url` HTTP headers and passes them directly to API client constructors without any SSRF validation.

### Affected Package

- **Ecosystem:** PyPI - **Package:** mcp-atlassian - **Affected versions:** all versions before fix commit 5cd697dfce91 - **Patched versions:** >= commit 5cd697dfce91

### Details

In `main.py`, `_process_authentication_headers()` extracts URLs from ASGI headers without validation. In `dependencies.py`, `get_jira_fetcher()` creates `JiraConfig` with `url=jira_url_header` directly. There is no `validate_url` call, no IP range check, no hostname validation.

The fix adds URL validation to some paths but the header-based URL extraction in `_process_authentication_headers()` still passes raw URLs through. The derived config objects use the header URL directly and the fetcher makes HTTP requests to that URL.

### PoC

```python jira_url_header = headers.get(b"x-atlassian-jira-url") jira_url_str = jira_url_header.decode("latin-1") if jira_url_header else None service_headers["X-Atlassian-Jira-Url"] = jira_url_str ```

**Steps to reproduce:** 1. `git clone https://github.com/sooperset/mcp-atlassian /tmp/mcp-atlassian_test` 2. `cd /tmp/mcp-atlassian_test && git checkout 5cd697dfce91~1` 3. `pip install -e .` 4. `python3 poc.py`

**Expected output:** ``` VULNERABILITY CONFIRMED User-supplied URLs from HTTP headers passed directly to JiraConfig/JiraFetcher wi…

Most recent entries from all

CVE-2026-77267 — mcp-atlassian has an incomplete SSRF remediation

GHSA-5wf4-jqxh-8gm3 — mcp-atlassian has an incomplete SSRF remediation