CVE-2026-77265: MCP Atlassian: DNS-rebinding SSRF exposes internal services

Q: Is CVE-2026-77265 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-77265, increasing the risk of exploitation.

Q: How to fix CVE-2026-77265?

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448 and commit b041733). 2) Do not expose the MCP server to untrusted networks; require authentication at a reverse proxy or gateway. 3) Enforce IMDSv2 (hop limit 1) or equivalent on cloud hosts and block egress to 169.254.169.254, link-local and RFC1918 ranges from the MCP host or container. 4) If possible, ignore or strip client-supplied X-Atlassian-*-Url headers and pin Jira/Confluence URLs through server-side configuration. 5) Detection: alert on outbound requests from the MCP server to internal or metadata addresses, repeated short-TTL DNS lookups for attacker-controlled domains, and unexpected access to metadata endpoints. 6) Inventory MCP servers and review which are reachable from outside trusted segments.

Q: What systems are affected by CVE-2026-77265?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling integrations, cloud-hosted AI agent deployments.

Q: What is the CVSS score for CVE-2026-77265?

CVE-2026-77265 has a CVSS v3.1 base score of 5.9 (MEDIUM). The EPSS exploitation probability is 0.29%.

GHSA-49xv-9743-pw8wMEDIUMPoC AVAILABLECISA: TRACK*

Published September 22, 2026

CISO Take

MCP Atlassian, an MCP server that connects AI agents to Jira and Confluence, has a DNS-rebinding SSRF flaw: URLs supplied in request headers are validated against one DNS answer but fetched using another, so an unauthenticated caller can reach internal or cloud metadata endpoints. Severity is medium (CVSS 5.9, high attack complexity), but a public PoC exists, the EPSS percentile is high (top 82%, raw score 0.27%), and CISA SSVC lists it as TRACK*, so it deserves prompt attention rather than routine backlog treatment. The package has only one tracked downstream dependent, but 38 other CVEs in the same package point to a weak security track record. The flaw is not in CISA KEV and no Nuclei template exists. Upgrade mcp-atlassian to 0.22.0 or later, and until then do not expose the server to untrusted networks and block egress to link-local and RFC1918 ranges.

Sources:NVDGitHub AdvisoryEPSSATLASCISA SSVC

What is the risk?

Medium overall, with elevated concern for exposed deployments. Exploitation needs no authentication or user interaction, but DNS rebinding timing makes it high complexity. Impact is confidentiality only (C:H, I:N, A:N). Risk rises sharply when the server runs in cloud environments where metadata services can return IAM credentials, or on internal networks with sensitive admin interfaces. A public PoC lowers the skill barrier. The EPSS score is low in absolute terms but ranks in the top 82% of all CVEs.

How does the attack unfold?

Initial Access

Attacker sends a request to the exposed MCP server with a crafted X-Atlassian-Jira-Url or X-Atlassian-Confluence-Url header pointing to a rebinding hostname.

AML.T0049

Validation Bypass

The hostname resolves to a public IP during validate_url_for_ssrf, then to an internal or metadata IP when the HTTP client reconnects (DNS rebinding).

Internal Access

The server issues requests to internal services or cloud metadata endpoints on the attacker's behalf.

AML.T0075

Impact

Sensitive internal data or cloud credentials are returned to the attacker, enabling lateral movement.

AML.T0055

Initial Access

Attacker sends a request to the exposed MCP server with a crafted X-Atlassian-Jira-Url or X-Atlassian-Confluence-Url header pointing to a rebinding hostname.

AML.T0049

Validation Bypass

The hostname resolves to a public IP during validate_url_for_ssrf, then to an internal or metadata IP when the HTTP client reconnects (DNS rebinding).

Internal Access

The server issues requests to internal services or cloud metadata endpoints on the attacker's behalf.

AML.T0075

Impact

Sensitive internal data or cloud credentials are returned to the attacker, enabling lateral movement.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MCP Atlassian	pip	< 0.22.0	`0.22.0`
2 dependents85% patched~4d to patchFull package profile →

Do you use MCP Atlassian? You're affected.

How severe is it?

CVSS 3.1

5.9 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448 and commit b041733). 2) Do not expose the MCP server to untrusted networks; require authentication at a reverse proxy or gateway. 3) Enforce IMDSv2 (hop limit 1) or equivalent on cloud hosts and block egress to 169.254.169.254, link-local and RFC1918 ranges from the MCP host or container. 4) If possible, ignore or strip client-supplied X-Atlassian-*-Url headers and pin Jira/Confluence URLs through server-side configuration. 5) Detection: alert on outbound requests from the MCP server to internal or metadata addresses, repeated short-TTL DNS lookups for attacker-controlled domains, and unexpected access to metadata endpoints. 6) Inventory MCP servers and review which are reachable from outside trusted segments.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassAgentPluginAPIAML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials AML.T0075- Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown or identified risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-77265?

Is CVE-2026-77265 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-77265, increasing the risk of exploitation.

How to fix CVE-2026-77265?

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448 and commit b041733). 2) Do not expose the MCP server to untrusted networks; require authentication at a reverse proxy or gateway. 3) Enforce IMDSv2 (hop limit 1) or equivalent on cloud hosts and block egress to 169.254.169.254, link-local and RFC1918 ranges from the MCP host or container. 4) If possible, ignore or strip client-supplied X-Atlassian-*-Url headers and pin Jira/Confluence URLs through server-side configuration. 5) Detection: alert on outbound requests from the MCP server to internal or metadata addresses, repeated short-TTL DNS lookups for attacker-controlled domains, and unexpected access to metadata endpoints. 6) Inventory MCP servers and review which are reachable from outside trusted segments.

What systems are affected by CVE-2026-77265?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling integrations, cloud-hosted AI agent deployments.

What is the CVSS score for CVE-2026-77265?

CVE-2026-77265 has a CVSS v3.1 base score of 5.9 (MEDIUM). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP serverstool-calling integrationscloud-hosted AI agent deployments

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

AML.T0075Cloud Service Discovery

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, header-supplied Jira or Confluence URLs are resolved and validated before the HTTP client resolves the hostname again for the connection. An unauthenticated caller can use a DNS-rebinding hostname that returns a public address during validation and an internal address during connection, causing requests to internal or metadata services. The advisory traces the vulnerable input and processing flow through X-Atlassian-Jira-Url, X-Atlassian-Confluence-Url, validate_url_for_ssrf, and DNS rebinding, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Exploitation Scenario

An attacker finds an internet-reachable or internally reachable mcp-atlassian HTTP endpoint. They register a domain with a short-TTL DNS server that first returns a public IP to pass the validate_url_for_ssrf check and then returns 169.254.169.254 or an internal address when the HTTP client reconnects. They send a request with X-Atlassian-Jira-Url set to that domain. The server fetches the internal resource, such as cloud instance metadata containing temporary IAM credentials, and the response data or error content is returned to the attacker, who then uses the credentials to pivot into the cloud environment.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.