CVE-2026-77265: MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow

This is a time-of-check to time-of-use gap. In servers/main.py (around lines 524 to 531), validate_url_for_ssrf() takes the X-Atlassian-Jira-Url value, resolves the hostname and checks the address is globally routable. Later, in servers/dependencies.py, a JiraFetcher built from that URL makes its own HTTP requests, with a fresh DNS lookup. The redirect hook (attach_ssrf_hook=True) only checks Location headers on redirects, not the first connection.

The attacker runs a hostname with a one-second TTL that answers 1.2.3.4 first, then 169.254.169.254. The reporter suggests using a rebinding service such as rbndr.us, with a host like rebind-169.254.169.254-1.2.3.4.rbndr.us and any value for X-Atlassian-Jira-Personal-Token. Each attempt succeeds roughly half the time, hence the high attack complexity in the CVSS score.

The attacker gets requests from the MCP host to cloud metadata, which can yield IAM credentials, or to internal services for scanning. The path is limited to the header_pat branch, so it matters for deployments that accept header-based PAT authentication over HTTP.

mcp-atlassian below 0.22.0 with an HTTP transport that accepts per-request X-Atlassian-Jira-Url and personal token headers. Deployments with a fixed server-side Atlassian URL do not take attacker-chosen hosts.

pip show mcp-atlassian

Upgrade to 0.22.0:

pip install --upgrade mcp-atlassian==0.22.0

The reporter's recommended design is to resolve the hostname once during validation and connect to that pinned IP, with the original name in the Host header, which removes the gap. If you cannot upgrade, do not expose the HTTP transport to untrusted clients, enforce IMDSv2 on cloud hosts, and block egress to link-local and internal ranges at the network layer.

Look for requests to the HTTP endpoint with X-Atlassian-Jira-Url values on rebinding services or unfamiliar domains with very low TTLs. DNS logs showing the same name resolving to a public and then a private or link-local address within seconds are the key signal. Check egress logs from the MCP host for connections to 169.254.169.254 or RFC 1918 ranges.

Summary

The SSRF protection for header-based authentication uses a validate-then-use pattern vulnerable to DNS rebinding. validate_url_for_ssrf resolves the hostname via DNS and checks that the resolved IP is globally routable. However, the actual HTTP request happens later, during which the DNS record may have changed to point to an internal IP (127.0.0.1, 169.254.169.254, etc.). The SSRF redirect hook only validates redirect targets, not the initial connection.

Details

The vulnerability spans main.py (validation) and dependencies.py (use).

Step 1 -- URL validation at middleware time:

In src/mcp_atlassian/servers/main.py:524-531, the URL from X-Atlassian-Jira-Url is validated:

if jira_url_str: ssrf_error = validate_url_for_ssrf(jira_url_str) if ssrf_error:

blocked

validate_url_for_ssrf (src/mcp_atlassian/utils/urls.py:113-116) resolves DNS and checks is_global:

dns_error = _check_dns_resolution(hostname) if dns_error: return dns_error

Step 2 -- HTTP request happens later with a separate DNS resolution:

In src/mcp_atlassian/servers/dependencies.py:544-562, a JiraFetcher is created with the attacker URL and makes HTTP requests to it. The SSRF redirect hook (attach_ssrf_hook=True) is applied but only checks redirect Location headers, not the initial connection target.

DNS rebinding timeline:

1. Attacker sets up rebind.attacker.com with short TTL (1 second)
2. First DNS resolution (validate_url_for_ssrf): returns 1.2.3.4 (public) -- passes
3. TTL expires
4. Second DNS resolution (requests.get): returns 169.254.169.254 (metadata)
5. HTTP request reaches internal IP, bypassing the SSRF check

PoC

Use a DNS rebinding service like rbndr.us. Send a request with X-Atlassian-Jira-Url set to a rebinding hostname (e.g., rebind-169.254.169.254-1.2.3.4.rbndr.us) and X-Atlassian-Jira-Personal-Token set to any value. With approximately 50% probability per attempt, the request reaches the internal metadata service.

Impact

• Cloud metadata access: Steal IAM credentials via 169.254.169.254
• Internal network scanning: Proxy requests to internal services
• AC:H: DNS rebinding is probabilistic and requires multiple attempts
• Limited to header_pat branch: Only affects deployments accepting header-based PAT authentication

Recommended Fix

Pin DNS resolution: resolve the hostname once during validation, then connect to the resolved IP directly (with the original hostname in the Host header). This eliminates the TOCTOU gap between validation and use.