CVE-2026-73497 MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)
Unauthenticated attackers can bypass SSRF protections via DNS rebinding to access cloud metadata or internal services in MCP Atlassian.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73497?
CVE-2026-73497 is a medium-severity server-side request forgery vulnerability in sooperset mcp-atlassian, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). From 0.17.0 until 0.22.0, validate_url_for_ssrf resolves the attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url header host once at middleware time, but the outbound request is built with the raw hostname and resolves it again at connection time with no IP pinning. An attacker-controlled DNS-rebinding name can return a public IP during validation and 169.254.169.254 or another internal IP during connection, enabling unauthenticated server-side requests to cloud metadata or internal services. The flaw spans src/mcp_atlassian/utils/urls.py, src/mcp_atlassian/servers/main.py, and src/mcp_atlassian/servers/dependencies.py; validate_url_for_ssrf returns only a verdict rather than a pinned IP, UserTokenMiddleware processes the attacker-controlled headers before fetcher creation, and the Jira and Confluence fetchers use the raw hostname. This issue is fixed in version 0.22.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-73497?
2 open source packages ship an affected version, including mcp-atlassian.
| Package | Affected | Fixed in |
|---|---|---|
mcp-atlassian PyPI | All versions | 0.22.0 |
mcp-atlassian PyPI | All versions | 0.22.0 |
How do I fix CVE-2026-73497?
Upgrade mcp-atlassian to 0.22.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-73497 being exploited?
There is no known exploitation of CVE-2026-73497 in the wild and no public exploit code.
Sources
Also known as GHSA-489g-7rxv-6c8q.