Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-73497— MCP Atlassian is a Model Context Protocol (MCP): DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826): unauthenticated SSRF to cloud metadata

Quick assessment

Affected
sooperset mcp-atlassian
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MCP Atlassian 是一个面向 Atlassian 产品（Confluence 和 Jira）的模型上下文协议（MCP）服务器。在 0.17.0 至 0.22.0 版本中， 函数在中间件阶段仅对攻击者可控制的 和 请求头中的主机名进行了一次 DNS 解析；然而，实际的外发请求却使用原始主机名构建，并在建立连接时再次进行 DNS 解析，且未做 IP 固定（IP pinning）。攻击者可利用 DNS 重绑定（DNS-rebinding）技术，使域名在验证阶段解析为公共 IP 地址，而在连接阶段解析为 169.

CVSS 6.5 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-73497

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MCP Atlassian is a Model Context Protocol (MCP): DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826): unauthenticated SSRF to cloud metadata
Source: CVE Program / CVE List V5
Vulnerability Description
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). From 0.17.0 until 0.22.0, validate_url_for_ssrf resolves the attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url header host once at middleware time, but the outbound request is built with the raw hostname and resolves it again at connection time with no IP pinning. An attacker-controlled DNS-rebinding name can return a public IP during validation and 169.254.169.254 or another internal IP during connection, enabling unauthenticated server-side requests to cloud metadata or internal services. The flaw spans src/mcp_atlassian/utils/urls.py, src/mcp_atlassian/servers/main.py, and src/mcp_atlassian/servers/dependencies.py; validate_url_for_ssrf returns only a verdict rather than a pinned IP, UserTokenMiddleware processes the attacker-controlled headers before fetcher creation, and the Jira and Confluence fetchers use the raw hostname. This issue is fixed in version 0.22.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sooperset mcp-atlassian >= 0.17.0, < 0.22.0 -

II. Public POCs for CVE-2026-73497

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-73497

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-73497 (1)

Vendor Advisories for CVE-2026-73497 (1)

Vendor Pages for CVE-2026-73497 (1)

IV. Related Vulnerabilities

Same product: mcp-atlassian
Same vendor: sooperset
Same weakness: CWE-918

V. Comments for CVE-2026-73497

No comments yet

Leave a comment