8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27826

CVE-2026-27826: MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, an unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL by supplying two custom HTTP headers without an Authorization header. No authentication is required. The vulnerability exists in the HTTP middleware and dependency injection layer — not in any MCP tool handler - making it invisible to tool-level code analysis. In cloud deployments, this could enable theft of IAM role credentials via the instance metadata endpoint (169[.]254[.]169[.]254). In any HTTP deployment it enables internal network reconnaissance and injection of attacker-controlled content into LLM tool results. Version 0.17.0 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27826

CVE-2026-27826:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mcp-atlassian	pip	< 0.17.0	0.17.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) that originates in the ASGI middleware layer of the mcp-atlassian server. The root cause is the lack of input validation on the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers when no Authorization header is present.

The exploitation flow is as follows:

An unauthenticated attacker sends a request to the /mcp endpoint with a malicious URL in the X-Atlassian-Jira-Url or X-Atlassian-Confluence-Url header.
The McpAtlassianMiddleware._process_authentication_headers function in src/mcp_atlassian/servers/main.py reads this header and, prior to the patch, stored the unvalidated URL in the request's state.
When a tool function is called, the dependency injection system invokes either get_jira_fetcher or get_confluence_fetcher from src/mcp_atlassian/servers/dependencies.py.
These functions retrieve the malicious URL from the state, instantiate a JiraFetcher or ConfluenceFetcher object with it, and immediately make an HTTP request to that URL to verify the user's identity (e.g., by calling get_current_user_account_id()).
This outbound request from the server to the attacker-controlled URL constitutes the SSRF, which can be used to scan internal networks, steal cloud instance metadata credentials, or inject malicious content into LLM agent sessions.

The patch mitigates this by adding a validate_url_for_ssrf function that is called within _process_authentication_headers to block malicious URLs before they are ever used. A secondary defense was also added to the fetcher functions to block SSRF via HTTP redirects.

Vulnerable functions

McpAtlassianMiddleware._process_authentication_headers

src/mcp_atlassian/servers/main.py

This middleware function is the entry point for the vulnerability. It extracts the `X-Atlassian-Jira-Url` and `X-Atlassian-Confluence-Url` headers from the request. Before the patch, it stored these URLs directly into the request state without any validation, allowing an attacker-controlled URL to be passed to downstream functions.

get_jira_fetcher

src/mcp_atlassian/servers/dependencies.py

This function consumes the unvalidated Jira URL from the request state, which was set by `_process_authentication_headers`. It then instantiates a `JiraFetcher` and immediately makes an outbound HTTP request by calling `get_current_user_account_id()`. This action triggers the Server-Side Request Forgery (SSRF) to the attacker-controlled URL.

get_confluence_fetcher

src/mcp_atlassian/servers/dependencies.py

Similar to `get_jira_fetcher`, this function consumes an unvalidated Confluence URL from the request state. It instantiates a `ConfluenceFetcher` and triggers an SSRF by calling `get_current_user_info()`, which makes an outbound HTTP request to the malicious URL provided in the `X-Atlassian-Confluence-Url` header.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.