CVE-2026-77242: MCP Atlassian: DNS rebinding bypasses SSRF protection

HIGHPoC AVAILABLECISA: TRACK*

Published September 22, 2026

CISO Take

MCP Atlassian, an MCP server connecting AI agents to Jira and Confluence, validates a URL's DNS answer before connecting, but the HTTP library resolves the hostname a second time. An attacker can return a public IP during validation and a private one at connection time (a TOCTOU/DNS rebinding flaw). This defeats the earlier CVE-2026-27826 fix and gives unauthenticated access to internal services and cloud metadata endpoints. The CVSS is 7.5 with a scope change, and the high attack complexity and low EPSS (0.003, 79th percentile) temper urgency. However, a public PoC exists, the CISA SSVC decision is TRACK*, and the package has had 38 other CVEs. It is not in CISA KEV. Upgrade mcp-atlassian to 0.22.0 or later and restrict the server's egress to internal ranges and metadata endpoints.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

High severity (CVSS 7.5, scope changed). Exploitation requires winning a DNS race or controlling a rebinding DNS server (high complexity), but needs no privileges or user interaction. A public PoC lowers the skill barrier. EPSS is low (0.003), and the flaw is not in CISA KEV or covered by a Nuclei template, so mass exploitation is unlikely today. The main risk is credential theft from cloud metadata services (IMDS) and reconnaissance of internal networks from hosts running the MCP server. The package has a history of repeated SSRF and other CVEs (38 total), which signals weak security hygiene. Overall risk is medium-high, driven by deployment context rather than raw exploit likelihood.

How does the attack unfold?

Initial Access

Attacker submits or induces a request containing a URL on a domain they control to the exposed mcp-atlassian server.

AML.T0049

Validation Bypass

A short-TTL DNS answer resolves to a public IP during validate_url_for_ssrf, passing the check.

AML.T0053

Exploitation

On the second resolution at connection time, the domain resolves to a private or metadata IP, and the server fetches it.

Impact

Internal service data or cloud IAM credentials are returned to the attacker, enabling lateral movement.

AML.T0055

Initial Access

Attacker submits or induces a request containing a URL on a domain they control to the exposed mcp-atlassian server.

AML.T0049

Validation Bypass

A short-TTL DNS answer resolves to a public IP during validate_url_for_ssrf, passing the check.

AML.T0053

Exploitation

On the second resolution at connection time, the domain resolves to a private or metadata IP, and the server fetches it.

Impact

Internal service data or cloud IAM credentials are returned to the attacker, enabling lateral movement.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MCP Atlassian	pip	—	No patch
2 dependents85% patched~4d to patchFull package profile →

Do you use MCP Atlassian? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 23% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SChanged

CHigh

ILow

ANone

What should I do?

1 step

1) Upgrade mcp-atlassian to 0.22.0 or later (PR #1448, commit b041733). 2) Until patched, block the MCP server's egress to RFC1918, link-local (169.254.169.254) and loopback ranges at the network or firewall layer. 3) Enforce IMDSv2 with a hop limit of 1, or disable instance metadata where unneeded. 4) Run the server in an isolated network segment with an allowlist of Atlassian domains only, ideally via an egress proxy that resolves DNS once and pins the IP. 5) Do not expose the MCP endpoint without authentication. 6) Monitor for outbound requests from the MCP host to internal ranges, unusually short-TTL DNS responses, and metadata endpoint access in cloud logs. 7) Rotate any cloud credentials that may have been exposed.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionAuth BypassAgentPluginAPIAML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Mechanisms to respond to and recover from unknown risks

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-77242?

Is CVE-2026-77242 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-77242, increasing the risk of exploitation.

How to fix CVE-2026-77242?

1) Upgrade mcp-atlassian to 0.22.0 or later (PR #1448, commit b041733). 2) Until patched, block the MCP server's egress to RFC1918, link-local (169.254.169.254) and loopback ranges at the network or firewall layer. 3) Enforce IMDSv2 with a hop limit of 1, or disable instance metadata where unneeded. 4) Run the server in an isolated network segment with an allowlist of Atlassian domains only, ideally via an egress proxy that resolves DNS once and pins the IP. 5) Do not expose the MCP endpoint without authentication. 6) Monitor for outbound requests from the MCP host to internal ranges, unusually short-TTL DNS responses, and metadata endpoint access in cloud logs. 7) Rotate any cloud credentials that may have been exposed.

What systems are affected by CVE-2026-77242?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, MCP servers, Tool-calling LLM agents, Enterprise knowledge integrations (Jira/Confluence).

What is the CVSS score for CVE-2026-77242?

CVE-2026-77242 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksMCP serversTool-calling LLM agentsEnterprise knowledge integrations (Jira/Confluence)

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when connecting. A caller can use a short-lived DNS answer that is public during validation and private during connection, preserving unauthenticated access to internal or metadata endpoints despite the earlier CVE-2026-27826 remediation. The advisory traces the vulnerable input and processing flow through validate_url_for_ssrf, _check_dns_resolution, socket.getaddrinfo, and _make_ssrf_safe_hook, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Exploitation Scenario

An attacker controls a domain served by a DNS server with a 0-1 second TTL that alternates answers. They submit a request to an exposed or prompt-injected mcp-atlassian instance (for example, a malicious Confluence page that causes the agent to fetch a URL). During validate_url_for_ssrf the domain resolves to a public IP and passes. When Requests/urllib3 reconnects, the domain resolves to 169.254.169.254. The server fetches the cloud metadata service and returns IAM role credentials in the response. The attacker then uses those credentials to pivot into the cloud environment.

Weaknesses (CWE)

CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition CWE-918Server-Side Request Forgery

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.