Server-Side Request Forgery Vulnerability in MCP Atlassian for Confluence and Jira

CVE-2026-77249

What is CVE-2026-77249?

MCP Atlassian, a server for Atlassian products such as Confluence and Jira, is vulnerable to a server-side request forgery issue. This vulnerability stems from the improper use of the requests.get function instead of utilizing the protected session, as seen in the JiraUserMixin._lookup_user_by_permissions method. An attacker can exploit this flaw by controlling a public Jira URL, which may redirect the unprotected request to an internal address and bypass critical redirect protections that were previously introduced. The vulnerability has been addressed in version 0.22.0.

References