Read the docs
TI-2026-51609 Aliases CVE-2026-73497

Server-side request forgery in sooperset mcp-atlassian

Priority LOW 29CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). From 0.17.0 until 0.22.0, validate_url_for_ssrf resolves the attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url header host once at middleware time, but the outbound request is built with the raw hostname and resolves it again at connection time with no IP pinning. An attacker-controlled DNS-rebinding name can return a public IP during validation and 169.254.169.254 or another internal IP during connection, enabling unauthenticated server-side requests to cloud metadata or internal services. The flaw spans src/mcp_atlassian/utils/urls.py, src/mcp_atlassian/servers/main.py, and src/mcp_atlassian/servers/dependencies.py; validate_url_for_ssrf returns only a verdict rather than a pinned IP, UserTokenMiddleware processes the attacker-controlled headers before fetcher creation, and the Jira and Confluence fetchers use the raw hostname. This issue is fixed in version 0.22.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00375 31st percentileScored 2026-11-07
Fix Fixed mcp-atlassian (sooperset): 0.22.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
soopersetmcp-atlassian0.17.0 to before 0.22.00.22.0Patch availableCNA
  • mcp-atlassian Vendorsooperset Affected 0.17.0 to before 0.22.0 Fixed in 0.22.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:mcp-atlassian:mcp_atlassian:*:*:*:*:*:*:*:*——Mcp-atlassian
  • cpe:2.3:a:mcp-atlassian:mcp_atlassian:*:*:*:*:*:*:*:* Versions — — ·Mcp-atlassian

Remediation

  • Fix · CNA mcp-atlassian (sooperset) Fixed in 0.22.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73497

References

Other 4

  • TI-2026-53938 MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials CVSS 3.1CRITICAL 9.1
  • TI-2026-53957 MCP Atlassian: SSRF Protection Bypass CVSS 4.0HIGH 8.8
  • TI-2026-53935 Protection mechanism failure in sooperset mcp-atlassian CVSS 4.0HIGH 8.3
  • TI-2026-53946 Path traversal in sooperset mcp-atlassian CVSS 3.1HIGH 8.6
  • TI-2026-53932 Path traversal in sooperset mcp-atlassian CVSS 3.1HIGH 8.6
  • TI-2026-22177 Path traversal in sooperset mcp-atlassian CVSS 3.1CRITICAL 9.1
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences