GHSA-5wf4-jqxh-8gm3

Suggest an improvement
Source
https://github.com/advisories/GHSA-5wf4-jqxh-8gm3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5wf4-jqxh-8gm3/GHSA-5wf4-jqxh-8gm3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5wf4-jqxh-8gm3
Aliases
Published
2026-09-22T20:36:17Z
Modified
2026-09-22T21:00:06Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator
Summary
mcp-atlassian has an incomplete SSRF remediation
Details

Summary

The UserTokenMiddleware extracts URLs from X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers and passes them directly to API client constructors without any SSRF validation.

Affected Package

  • Ecosystem: PyPI
  • Package: mcp-atlassian
  • Affected versions: all versions before fix commit 5cd697dfce91
  • Patched versions: >= commit 5cd697dfce91

Details

In main.py, _process_authentication_headers() extracts URLs from ASGI headers without validation. In dependencies.py, get_jira_fetcher() creates JiraConfig with url=jira_url_header directly. There is no validate_url call, no IP range check, no hostname validation.

The fix adds URL validation to some paths but the header-based URL extraction in _process_authentication_headers() still passes raw URLs through. The derived config objects use the header URL directly and the fetcher makes HTTP requests to that URL.

PoC

jira_url_header = headers.get(b"x-atlassian-jira-url")
jira_url_str = jira_url_header.decode("latin-1") if jira_url_header else None
service_headers["X-Atlassian-Jira-Url"] = jira_url_str

Steps to reproduce:

  1. git clone https://github.com/sooperset/mcp-atlassian /tmp/mcp-atlassian_test
  2. cd /tmp/mcp-atlassian_test && git checkout 5cd697dfce91~1
  3. pip install -e .
  4. python3 poc.py

Expected output:

VULNERABILITY CONFIRMED
User-supplied URLs from HTTP headers passed directly to JiraConfig/JiraFetcher with no SSRF validation

Impact

An attacker can set X-Atlassian-Jira-Url: http://169.254.169.254/latest/meta-data/ to access AWS instance metadata, or target any internal service. The server makes authenticated HTTP requests to the attacker-specified URL.

Suggested Remediation

Validate all user-supplied URLs against an allowlist of permitted hostnames or reject private/loopback/link-local IP ranges. Consider requiring server-side configuration of allowed Atlassian instance URLs.

Database specific 
{
    "cwe_ids":  [
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-22T20:36:17Z",
    "nvd_published_at":  "2026-09-22T18:17:18Z",
    "severity":  "HIGH"
}
References

Affected packages

PyPI / mcp-atlassian

Package

Name
mcp-atlassian
View open source insights on deps.dev
Purl
pkg:pypi/mcp-atlassian

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.22.0

Affected versions

0.*
0.1.1
0.1.2
0.1.3
0.1.4
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14
0.1.15
0.1.16
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.3.0
0.3.1
0.4.0
0.5.0
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.9.0
0.10.0
0.10.1
0.10.2
0.10.3
0.10.4
0.10.5
0.10.6
0.11.0
0.11.1
0.11.2a2
0.11.2
0.11.3
0.11.4
0.11.5
0.11.6
0.11.7
0.11.8
0.11.9
0.11.10
0.11.11
0.11.12
0.12.0
0.13.0
0.13.1
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.16.0
0.16.1
0.17.0
0.18.0
0.18.1
0.19.0
0.20.0
0.20.1
0.21.0
0.21.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5wf4-jqxh-8gm3/GHSA-5wf4-jqxh-8gm3.json"