CVE-2026-77261: mcp-atlassian: SSRF via unvalidated redirects

Q: Is CVE-2026-77261 actively exploited?

No confirmed active exploitation of CVE-2026-77261 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-77261?

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Until patched, restrict egress from the MCP host: block access to link-local/metadata addresses (169.254.169.254), RFC1918 ranges, and localhost except for required destinations. 3) Enforce IMDSv2 or equivalent metadata protections on cloud hosts. 4) Only point the server at trusted, verified Atlassian instances and review the configured base URLs. 5) Monitor outbound connections from the MCP process to internal ranges and log unexpected 3xx redirect chains from Atlassian endpoints. 6) Run the MCP server with least-privilege network and credential scope.

Q: What systems are affected by CVE-2026-77261?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling AI agents, enterprise knowledge integrations.

Q: What is the CVSS score for CVE-2026-77261?

CVE-2026-77261 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.37%.

GHSA-6529-c226-h328HIGH

Published September 22, 2026

CISO Take

MCP Atlassian, a Model Context Protocol server that lets AI agents reach Jira and Confluence, skips its SSRF-protection hook on sessions created through the basic-auth and oauth_pat code paths, so it follows HTTP redirects to internal addresses without revalidating them. Exploitation requires a malicious or compromised Atlassian instance that the server is configured to talk to, which keeps the CVSS at 7.1 (high attack complexity, scope changed). Real-world pressure is low: EPSS is 0.00321 (77th percentile), there is no public exploit, no Nuclei template, it is not in CISA KEV, and CISA SSVC says TRACK. Blast radius is limited (1 downstream dependent), but the package has 38 other CVEs, so it is a recurring-risk component. Upgrade mcp-atlassian to 0.22.0 or later, and verify that agent hosts running it cannot reach cloud metadata endpoints or internal admin services.

Sources:NVDGitHub AdvisoryEPSSATLASCISA SSVC

What is the risk?

Medium-to-high for organizations running mcp-atlassian against self-hosted or third-party Atlassian instances. The attack needs a hostile or compromised upstream instance (high complexity) and low privileges, but the changed scope and high confidentiality impact mean that a successful redirect to internal services (cloud metadata, internal APIs) can expose credentials and data beyond the vulnerable component. Exploitation likelihood is low (EPSS 0.00321, no public exploit, not in KEV, SSVC TRACK).

How does the attack unfold?

Initial Access

Attacker controls or compromises an Atlassian instance that the MCP server is configured to use with basic-auth or OAuth PAT.

AML.T0010.005

Exploitation

The agent triggers a Jira/Confluence tool call and the malicious instance returns a redirect to an internal address that the unprotected session follows without validation.

AML.T0053

Collection

The server fetches internal resources such as cloud metadata or internal APIs and returns the content through the tool response.

AML.T0085.001

Impact

Exposed credentials or internal data enable lateral movement and further compromise beyond the MCP server.

AML.T0025

Initial Access

Attacker controls or compromises an Atlassian instance that the MCP server is configured to use with basic-auth or OAuth PAT.

AML.T0010.005

Exploitation

The agent triggers a Jira/Confluence tool call and the malicious instance returns a redirect to an internal address that the unprotected session follows without validation.

AML.T0053

Collection

The server fetches internal resources such as cloud metadata or internal APIs and returns the content through the tool response.

AML.T0085.001

Impact

Exposed credentials or internal data enable lateral movement and further compromise beyond the MCP server.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MCP Atlassian	pip	< 0.22.0	`0.22.0`
2 dependents85% patched~4d to patchFull package profile →

Do you use MCP Atlassian? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SChanged

CHigh

ILow

ANone

What should I do?

1 step

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Until patched, restrict egress from the MCP host: block access to link-local/metadata addresses (169.254.169.254), RFC1918 ranges, and localhost except for required destinations. 3) Enforce IMDSv2 or equivalent metadata protections on cloud hosts. 4) Only point the server at trusted, verified Atlassian instances and review the configured base URLs. 5) Monitor outbound connections from the MCP process to internal ranges and log unexpected 3xx redirect chains from Atlassian endpoints. 6) Run the MCP server with least-privilege network and credential scope.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionData LeakageAgentPluginAPIAML.T0010.005- AI Agent Tool AML.T0053- AI Agent Tool Invocation AML.T0085.001- AI Agent Tools

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Response to unknown risks and mechanisms for deactivating AI systems

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-77261?

Is CVE-2026-77261 actively exploited?

No confirmed active exploitation of CVE-2026-77261 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-77261?

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Until patched, restrict egress from the MCP host: block access to link-local/metadata addresses (169.254.169.254), RFC1918 ranges, and localhost except for required destinations. 3) Enforce IMDSv2 or equivalent metadata protections on cloud hosts. 4) Only point the server at trusted, verified Atlassian instances and review the configured base URLs. 5) Monitor outbound connections from the MCP process to internal ranges and log unexpected 3xx redirect chains from Atlassian endpoints. 6) Run the MCP server with least-privilege network and credential scope.

What systems are affected by CVE-2026-77261?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling AI agents, enterprise knowledge integrations.

What is the CVSS score for CVE-2026-77261?

CVE-2026-77261 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.37%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP serverstool-calling AI agentsenterprise knowledge integrations

MITRE ATLAS Techniques

AML.T0010.005AI Agent Tool

AML.T0053AI Agent Tool Invocation

AML.T0085.001AI Agent Tools

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, _make_ssrf_safe_hook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauth_pat branches. If an attacker-controlled or compromised configured Atlassian instance returns a redirect to an internal address, those sessions can follow the redirect without revalidating its destination. This issue is fixed in version 0.22.0.

Exploitation Scenario

An attacker compromises, or convinces a user to configure, an Atlassian instance URL they control (for example a rogue self-hosted Confluence). When an AI agent invokes a Jira or Confluence tool through mcp-atlassian using basic-auth or OAuth PAT, the attacker's server answers with a redirect to an internal address such as the cloud metadata service. The vulnerable session follows the redirect without revalidation and returns the response to the fetcher, exposing instance credentials or internal service data that the attacker can then use for lateral movement.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.