mcp-atlassian has an incomplete SSRF remediation
- Product
- mcp-atlassian
- CVE
- CVE-2026-77267
- Affected
- mcp-atlassian < 0.22.0
- Fixed in
- 0.22.0
Last verified against sources: October 26, 2026
Am I affected?
mcp-atlassian: affected mcp-atlassian < 0.22.0. Fixed in 0.22.0.
- Check your version: run
pip show mcp-atlassian. Versions < 0.22.0 of mcp-atlassian are affected. [1]
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "mcp-atlassian>=0.22.0"(first patched version 0.22.0). [1] - Validate all user-supplied URLs against an allowlist of permitted hostnames. [1]
- Reject private, loopback, and link-local IP ranges. [1]
- Consider requiring server-side configuration of allowed Atlassian instance URLs. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- mcp-atlassian reads URLs from the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers. [1]
- It passes those URLs straight to its API client code without any SSRF validation. [1]
- The fix adds URL validation to some code paths, but the header-based URL extraction still passes raw URLs through. [1]
Impact
What was done
Sources
- GHSA-5wf4-jqxh-8gm3 — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-77267] mcp-atlassian has an incomplete SSRF remediation
Product: mcp-atlassian | Affected: mcp-atlassian < 0.22.0 | Fixed in: 0.22.0
Summary: mcp-atlassian reads URLs from the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/09/cve-2026-77267-mcp-atlassianCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-77267
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.