Server-Side Request Forgery Vulnerability in MCP Atlassian for Confluence and Jira

CVE-2026-73497

What is CVE-2026-73497?

The vulnerability in MCP Atlassian affects versions 0.17.0 to 0.22.0, where improper handling of attacker-controlled headers allows for potential server-side request forgery. Specifically, the function validate_url_for_ssrf resolves the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url header hosts once during middleware processing, but the outbound request construction utilizes the unverified hostname, leading to repeated resolution during connection time. This flaw can exploit DNS rebinding techniques, which permits unauthenticated requests to internal IP addresses and cloud metadata. The issue has been addressed in version 0.22.0, emphasized by fixes within the affected components.

References