CVE-2026-19369

Name of the Vulnerable Software and Affected Versions KS-GEN-AI jira-mcp-server version 0.2.0

Description An issue exists in the add attachment from public url component within the src/index.ts file. The axios.get() function is susceptible to server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. This occurs through the manipulation of the imageUrl argument and requires a local approach for exploitation.

Recommendations As a temporary workaround, restrict the use of the imageUrl argument within the add attachment from public url component until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.