CVE-2026-27826
Published: 10 March 2026
Summary
CVE-2026-27826 is a high-severity SSRF (CWE-918) vulnerability in Sooperset Mcp Atlassian. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Service Discovery (T1046); ranked at the 24.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of known flaws, such as upgrading to MCP Atlassian version 0.17.0 which fixes the SSRF vulnerability in the HTTP middleware.
Enforces boundary protection to monitor and control outbound HTTP requests from the server, blocking access to arbitrary URLs including cloud metadata endpoints.
Validates inputs like custom HTTP headers to prevent injection of arbitrary URLs that trigger SSRF outbound requests.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF enables internal network reconnaissance mapping to Network Service Discovery (T1046) and theft of IAM credentials via cloud instance metadata endpoint mapping to Cloud Instance Metadata API (T1552.005).
NVD Description
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, an unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to…
more
an arbitrary attacker-controlled URL by supplying two custom HTTP headers without an `Authorization` header. No authentication is required. The vulnerability exists in the HTTP middleware and dependency injection layer — not in any MCP tool handler - making it invisible to tool-level code analysis. In cloud deployments, this could enable theft of IAM role credentials via the instance metadata endpoint (`169[.]254[.]169[.]254`). In any HTTP deployment it enables internal network reconnaissance and injection of attacker-controlled content into LLM tool results. Version 0.17.0 fixes the issue.
Deeper analysisAI
MCP Atlassian is a Model Context Protocol (MCP) server designed for integration with Atlassian products such as Confluence and Jira. Versions prior to 0.17.0 contain a vulnerability (CVE-2026-27826, CWE-918) that allows an unauthenticated attacker to force the server process to make outbound HTTP requests to arbitrary attacker-controlled URLs. This server-side request forgery (SSRF) issue arises in the HTTP middleware and dependency injection layer, rather than in MCP tool handlers, rendering it undetectable by tool-level code analysis. The vulnerability has a CVSS v3.1 score of 8.2 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
An unauthenticated attacker with adjacent network access to the mcp-atlassian HTTP endpoint can exploit this by supplying two custom HTTP headers without an Authorization header. Successful exploitation enables the attacker to conduct internal network reconnaissance from the server's perspective. In cloud deployments, it facilitates theft of IAM role credentials by targeting the instance metadata endpoint at 169.254.169.254. Across any HTTP deployment, it allows injection of attacker-controlled content into LLM tool results.
The GitHub security advisory (GHSA-7r34-79r5-rcc9) and fixing commit (5cd697dfce9116ef330b8dc7a91291640e0528d9) confirm that upgrading to version 0.17.0 resolves the issue.
This vulnerability is particularly relevant to AI/ML deployments, as MCP servers bridge LLMs with enterprise tools, potentially exposing LLM integrations to SSRF-based content manipulation or credential theft. No real-world exploitation has been reported.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Protocol-Specific Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: mcp, model context protocol, mcp, mcp, mcp, llm