VulnSocial

CVE-2026-77242Disclosure(mcp-atlassian / mcp_atlassian)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when connecting. A caller can use a short-lived DNS answer that is public during validation and private during connection, preserving unauthenticated access to internal or metadata endpoints despite the earlier CVE-2026-27826 remediation. The advisory traces the vulnerable input and processing flow through validate_url_for_ssrf, _check_dns_resolution, socket.getaddrinfo, and _make_ssrf_safe_hook, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

mcp-atlassian CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-367CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • mcp_atlassian

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
mcp-atlassian
Products
mcp_atlassian

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-23: 1Technical Details · 2026-09-23: 109-23
Signal classification1 categories
Disclosure
1100.0%
Full discourse1 post
  • Daniel Cuthbert@dcuthbert
    Disclosure

    Seriously @Atlassian asking for the community here. How on gods green earth did you end up shipping MCP server full of appsec bugs? CVE-2026-77242 SSRF CVE-2026-77267 validation bypass CVE-2026-77269 path traversal With all the AI, you still had bugs older than most

    Post summary

    The text identifies three Atlassian CVEs (2026-77242, 2026-77267, 2026-77269) with technical vulnerability types, criticizing their presence but without exploit details, active exploitation, or remediation guidance.

    7014483.0K
    33.7K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appmcp-atlassianmcp_atlassian---

Explore more

Back to dashboardmcp-atlassian CVEsmcp_atlassian vulnerabilities