Yunkaiwjs

**Name of the Vulnerable Software and Affected Versions** MCP Atlassian versions prior to 0.22.0 **Description** A server-side request forgery (SSRF) exists due to an incomplete fix for a previous issue. The `JiraUserMixin. lookup user by permissions` function uses the module-level `requests.get` function instead of the protected session. This allows an unauthenticated attacker using HTTP multi-tenant transport mode to provide a public Jira URL that passes initial validation but subsequently redirects the request to an internal address. Because the module-level call bypasses the redirect-validation hook ` make ssrf safe hook`, the server follows the redirect to an arbitrary internal host and port. This results in a blind SSRF, enabling internal service reachability, port discovery, and access to cloud metadata endpoints. **Recommendations** Update to version 0.22.0. As a temporary mitigation, restrict access to the HTTP transport endpoint to minimize the risk of unauthenticated exploitation.