Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mcp-atlassian | pip | < 0.22.0 | 0.22.0 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-77261, describes an incomplete fix for a previous SSRF issue where redirect protection (_make_ssrf_safe_hook()) was not consistently applied across all authentication branches in the mcp-atlassian library. The core problem was that the attach_ssrf_hook=True parameter was only passed to the _create_and_validate() function in the 'header-PAT' authentication branch, leaving 'basic auth' and 'OAuth/PAT' branches unprotected.
The provided commit b041733473f95119dd539542a43c280737a8e460 directly addresses this by modifying src/mcp_atlassian/servers/dependencies.py. The patch clearly shows the addition of attach_ssrf_hook=True to the calls to _create_and_validate within the _get_fetcher function for the 'basic' and 'oauth_pat' authentication paths. Therefore, the _get_fetcher function is identified as the vulnerable component because its logic, in the unpatched version, failed to enable a critical security control for specific authentication flows. When exploited, a runtime profiler would show execution within _get_fetcher leading to the creation of an unprotected session, which would then follow a malicious redirect.
_get_fetchersrc/mcp_atlassian/servers/dependencies.py