Veille CVE

‹ Retour à la liste

CVE-2026-77265

7.5 Élevée

Publiée le 22/09/2026 à 20:17 · Modifiée le 29/09/2026 à 21:00 · Analysée par le NVD · Source : security-advisories@github.com

Description

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, header-supplied Jira or Confluence URLs are resolved and validated before the HTTP client resolves the hostname again for the connection. An unauthenticated caller can use a DNS-rebinding hostname that returns a public address during validation and an internal address during connection, causing requests to internal or metadata services. The advisory traces the vulnerable input and processing flow through X-Atlassian-Jira-Url, X-Atlassian-Confluence-Url, validate_url_for_ssrf, and DNS rebinding, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
3.1 5.9 Moyenne security-advisories@github.com CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1 7.5 Élevée nvd@nist.gov (NVD) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Faiblesses (CWE)

Références

Ailleurs