VulnSocial

CVE-2026-77267Disclosure(mcp-atlassian / mcp_atlassian)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by _process_authentication_headers and used to construct Atlassian fetchers without calling validate_url_for_ssrf. A caller who can set these headers can supply an internal or metadata-service URL and cause the server to send requests to that destination, bypassing the incomplete CVE-2026-27826 remediation. This issue is fixed in version 0.22.0.

mcp-atlassian CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • mcp_atlassian

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
mcp-atlassian
Products
mcp_atlassian

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-23: 1Technical Details · 2026-09-23: 109-23
Signal classification1 categories
Disclosure
1100.0%
Full discourse1 post
  • Daniel Cuthbert@dcuthbert
    Disclosure

    Seriously @Atlassian asking for the community here. How on gods green earth did you end up shipping MCP server full of appsec bugs? CVE-2026-77242 SSRF CVE-2026-77267 validation bypass CVE-2026-77269 path traversal With all the AI, you still had bugs older than most

    Post summary

    The text highlights multiple CVEs in Atlassian's MCP server, providing vulnerability types but lacking details on exploitation, patches, or PoCs, with a critical tone toward the vendor.

    7014483.0K
    33.7K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appmcp-atlassianmcp_atlassian---

Explore more

Back to dashboardmcp-atlassian CVEsmcp_atlassian vulnerabilities