CVE-2026-77249

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0

Description A server-side request forgery (SSRF) exists due to an incomplete fix for a previous issue. The JiraUserMixin. lookup user by permissions function uses the module-level requests.get function instead of the protected session. This allows an unauthenticated attacker using HTTP multi-tenant transport mode to provide a public Jira URL that passes initial validation but subsequently redirects the request to an internal address. Because the module-level call bypasses the redirect-validation hook make ssrf safe hook, the server follows the redirect to an arbitrary internal host and port. This results in a blind SSRF, enabling internal service reachability, port discovery, and access to cloud metadata endpoints.

Recommendations Update to version 0.22.0. As a temporary mitigation, restrict access to the HTTP transport endpoint to minimize the risk of unauthenticated exploitation.