CVE-2026-77274: mcp-atlassian: SSRF via backslash URL parsing confusion

Q: Is CVE-2026-77274 actively exploited?

No confirmed active exploitation of CVE-2026-77274 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-77274?

1) Upgrade mcp-atlassian to 0.22.0 or later (pip install -U mcp-atlassian). 2) Until patched, avoid exposing the server over HTTP to untrusted callers and disable or restrict header-based URL and auth overrides, pinning the Jira and Confluence base URLs by configuration. 3) Apply egress filtering so the MCP host cannot reach internal ranges, link-local metadata addresses (169.254.169.254), or admin interfaces; enforce IMDSv2 on cloud hosts. 4) Run the server with least privilege and in an isolated network segment. 5) Detect by reviewing logs for requests containing backslashes or unusual authority components in Jira or Confluence URL parameters, and for outbound connections from the MCP host to internal addresses. 6) Inventory mcp-atlassian instances across developer machines and agent platforms.

Q: What systems are affected by CVE-2026-77274?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling LLM agents, enterprise SaaS integrations.

Q: What is the CVSS score for CVE-2026-77274?

No CVSS score has been assigned yet.

GHSA-hgcf-4mq8-5266HIGHCISA: TRACK*

Published September 22, 2026

CISO Take

MCP Atlassian, an MCP server that lets AI agents read and write Jira and Confluence, has an SSRF filter that parses URLs differently from the HTTP client that actually makes the request. A crafted URL with a backslash in the authority passes validation as an external host while the request goes to an internal one, letting an attacker reach protected network resources from the server's position. Exploitation likelihood is currently modest (EPSS 0.32%, top 77%, no public exploit, no Nuclei template, not in CISA KEV, SSVC TRACK*), and the package has only 1 tracked downstream dependent, so broad blast radius is unlikely. The real exposure is in deployments where the server is network-reachable or fed attacker-influenced URLs, such as header-based auth flows in multi-tenant or shared setups, where it may sit near cloud metadata endpoints and internal services. Upgrade to mcp-atlassian 0.22.0 or later, and note that this package has 38 other CVEs, so review its overall security posture and network placement.

Sources:NVDEPSSGitHub AdvisoryATLASCISA SSVC

What is the risk?

Moderate-to-high severity but low near-term exploitation likelihood. The flaw is CWE-918 SSRF caused by a parser differential between the validator and the Requests library. No CVSS vector is published, so impact depends on deployment. Risk is highest where the MCP server runs in a cloud or internal network with access to metadata services, internal admin interfaces, or unauthenticated internal APIs, and where callers can supply the Jira or Confluence URL through headers. Risk is lower for local, single-user stdio deployments. No KEV listing and no public exploit are known as of the publication date. Confidence: MEDIUM, given the missing CVSS data.

How does the attack unfold?

Initial Access

Attacker supplies a crafted URL with a backslash in the authority via header-based Jira or Confluence URL configuration, or through an agent tool call.

AML.T0049

Validation Bypass

validate_url_for_ssrf treats the URL as an external hostname while Requests parses the authority differently and targets an internal host.

AML.T0053

Internal Access

The MCP server issues requests to protected internal resources such as metadata services or admin interfaces and returns the responses.

Impact

Internal data or credentials are disclosed, enabling reconnaissance and lateral movement from the MCP host's network position.

Initial Access

Attacker supplies a crafted URL with a backslash in the authority via header-based Jira or Confluence URL configuration, or through an agent tool call.

AML.T0049

Validation Bypass

validate_url_for_ssrf treats the URL as an external hostname while Requests parses the authority differently and targets an internal host.

AML.T0053

Internal Access

The MCP server issues requests to protected internal resources such as metadata services or admin interfaces and returns the responses.

Impact

Internal data or credentials are disclosed, enabling reconnaissance and lateral movement from the MCP host's network position.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MCP Atlassian	pip	< 0.22.0	`0.22.0`
2 dependents85% patched~4d to patchFull package profile →

Do you use MCP Atlassian? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

1) Upgrade mcp-atlassian to 0.22.0 or later (pip install -U mcp-atlassian). 2) Until patched, avoid exposing the server over HTTP to untrusted callers and disable or restrict header-based URL and auth overrides, pinning the Jira and Confluence base URLs by configuration. 3) Apply egress filtering so the MCP host cannot reach internal ranges, link-local metadata addresses (169.254.169.254), or admin interfaces; enforce IMDSv2 on cloud hosts. 4) Run the server with least privilege and in an isolated network segment. 5) Detect by reviewing logs for requests containing backslashes or unusual authority components in Jira or Confluence URL parameters, and for outbound connections from the MCP host to internal addresses. 6) Inventory mcp-atlassian instances across developer machines and agent platforms.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassAgentPluginAPIAML.T0010.005- AI Agent Tool AML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-77274?

Is CVE-2026-77274 actively exploited?

No confirmed active exploitation of CVE-2026-77274 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-77274?

1) Upgrade mcp-atlassian to 0.22.0 or later (pip install -U mcp-atlassian). 2) Until patched, avoid exposing the server over HTTP to untrusted callers and disable or restrict header-based URL and auth overrides, pinning the Jira and Confluence base URLs by configuration. 3) Apply egress filtering so the MCP host cannot reach internal ranges, link-local metadata addresses (169.254.169.254), or admin interfaces; enforce IMDSv2 on cloud hosts. 4) Run the server with least privilege and in an isolated network segment. 5) Detect by reviewing logs for requests containing backslashes or unusual authority components in Jira or Confluence URL parameters, and for outbound connections from the MCP host to internal addresses. 6) Inventory mcp-atlassian instances across developer machines and agent platforms.

What systems are affected by CVE-2026-77274?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling LLM agents, enterprise SaaS integrations.

What is the CVSS score for CVE-2026-77274?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP serverstool-calling LLM agentsenterprise SaaS integrations

MITRE ATLAS Techniques

AML.T0010.005AI Agent Tool

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

Compliance Controls Affected

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL authentication flow. A crafted URL can validate as an external hostname while the HTTP client connects to an internal host, permitting server-side requests to protected network resources. This issue is fixed in version 0.22.0.

Exploitation Scenario

An attacker who can reach a shared, HTTP-hosted mcp-atlassian instance, or who can influence the Jira or Confluence URL supplied through request headers, submits a URL such as one with a backslash in the authority component that looks like an external hostname to validate_url_for_ssrf. The Requests layer interprets the authority differently and connects to an internal host, for example a cloud metadata service or an internal admin panel. The server returns the response data to the caller or agent, which exposes credentials or internal service details that the attacker then uses for lateral movement. The same path could be reached by a prompt-injected agent that passes an attacker-chosen URL to the tool.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.