{"schema_version":"2","view":"grouped","data":[{"id":3262,"cve_ids":["CVE-2026-77265"],"payload":{"kind":"advisory","title":"MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow","summary":"MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, header-supplied Jira or Confluence URLs are resolved and validated before the HTTP client resolves the hostname again for the connection. An unauthenticated caller can use a DNS-rebinding hostname that returns a public address during validation and an internal address during connection, causing requests to internal or metadata services. The advisory traces the vulnerable input and processing flow through X-Atlassian-Jira-Url, X-Atlassian-Confluence-Url, validate_url_for_ssrf, and DNS rebinding, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.","evidence":"cve:CVE-2026-77265","products":[{"name":{"value":"mcp-atlassian","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-77265","aliases":["CVE-2026-77265"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"sooperset","product":"mcp-atlassian","versions":[{"status":"affected","version":"< 0.22.0"}]}],"modified":"2026-09-28T17:46:45.112Z","provider":"cve","references":["https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-49xv-9743-pw8w","https://github.com/sooperset/mcp-atlassian/pull/1448","https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460","https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-77265","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:46:36.949461Z"}}}],"references":[{"url":"https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-49xv-9743-pw8w","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:46:45.112Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-22T17:47:58.553Z"}}},"related_cves":[{"value":"CVE-2026-77265","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:873ac0d8-f318-4cc1-aa9e-4f4b7685a3d0","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77265","advisory_id":"873ac0d8-f318-4cc1-aa9e-4f4b7685a3d0","event_types":["advisory"],"published_at":"2026-10-24T21:32:02.691733+00:00","technologies":["core-cve","mcp-atlassian"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-22T17:47:58.553+00:00","detail_url":"/advisories/advisory%3A873ac0d8-f318-4cc1-aa9e-4f4b7685a3d0","group":{"id":"advisory:873ac0d8-f318-4cc1-aa9e-4f4b7685a3d0","revision":1,"primary_event_id":3274,"change":"published","superseded_by":[],"changed":{"id":3274,"cve_ids":["CVE-2026-77265"],"payload":{"kind":"advisory","title":"MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow","summary":"MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, header-supplied Jira or Confluence URLs are resolved and validated before the HTTP client resolves the hostname again for the connection. An unauthenticated caller can use a DNS-rebinding hostname that returns a public address during validation and an internal address during connection, causing requests to internal or metadata services. The advisory traces the vulnerable input and processing flow through X-Atlassian-Jira-Url, X-Atlassian-Confluence-Url, validate_url_for_ssrf, and DNS rebinding, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.","evidence":"cve:CVE-2026-77265","products":[{"name":{"value":"mcp-atlassian","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-77265","aliases":["CVE-2026-77265"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"sooperset","product":"mcp-atlassian","versions":[{"status":"affected","version":"< 0.22.0"}]}],"modified":"2026-09-28T17:46:45.112Z","provider":"cve","references":["https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-49xv-9743-pw8w","https://github.com/sooperset/mcp-atlassian/pull/1448","https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460","https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-77265","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:46:36.949461Z"}}}],"references":[{"url":"https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-49xv-9743-pw8w","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:46:45.112Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-22T17:47:58.553Z"}}},"related_cves":[{"value":"CVE-2026-77265","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:873ac0d8-f318-4cc1-aa9e-4f4b7685a3d0","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77265","advisory_id":"873ac0d8-f318-4cc1-aa9e-4f4b7685a3d0","event_types":["advisory"],"published_at":"2026-10-24T21:32:02.691733+00:00","technologies":["core-cve","mcp-atlassian"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-22T17:47:58.553+00:00","detail_url":"/events/3274"},"members":[{"id":3274,"cve_ids":["CVE-2026-77265"],"payload":{"kind":"advisory","title":"MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow","summary":"MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, header-supplied Jira or Confluence URLs are resolved and validated before the HTTP client resolves the hostname again for the connection. An unauthenticated caller can use a DNS-rebinding hostname that returns a public address during validation and an internal address during connection, causing requests to internal or metadata services. The advisory traces the vulnerable input and processing flow through X-Atlassian-Jira-Url, X-Atlassian-Confluence-Url, validate_url_for_ssrf, and DNS rebinding, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.","evidence":"cve:CVE-2026-77265","products":[{"name":{"value":"mcp-atlassian","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-77265","aliases":["CVE-2026-77265"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"sooperset","product":"mcp-atlassian","versions":[{"status":"affected","version":"< 0.22.0"}]}],"modified":"2026-09-28T17:46:45.112Z","provider":"cve","references":["https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-49xv-9743-pw8w","https://github.com/sooperset/mcp-atlassian/pull/1448","https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460","https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-77265","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:46:36.949461Z"}}}],"references":[{"url":"https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-49xv-9743-pw8w","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:46:45.112Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-22T17:47:58.553Z"}}},"related_cves":[{"value":"CVE-2026-77265","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:873ac0d8-f318-4cc1-aa9e-4f4b7685a3d0","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77265","advisory_id":"873ac0d8-f318-4cc1-aa9e-4f4b7685a3d0","event_types":["advisory"],"published_at":"2026-10-24T21:32:02.691733+00:00","technologies":["core-cve","mcp-atlassian"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-22T17:47:58.553+00:00","detail_url":"/events/3274"}]}}],"next_after":3262,"next_before":3262}