MCP Atlassian TOCTOU DNS Rebinding SSRF via Attacker-Controlled Headers
First seen Sep 15, 2026 · Updated Sep 15, 2026 · CVSS 6.5
The MCP Atlassian server validates a user-supplied Jira/Confluence hostname once but then resolves and connects to that hostname again later, letting an attacker use DNS rebinding to swap a benign public IP for an internal address (like the cloud metadata service) between checks. This allows unauthenticated server-side requests into internal networks or cloud metadata endpoints. It is a classic time-of-check-to-time-of-use SSRF bypass affecting an AI agent tool server rather than the AI model itself.
Technical Analysis
The vulnerability is a time-of-check-to-time-of-use (TOCTOU) flaw: UserTokenMiddleware calls validate_url_for_ssrf on the attacker-controlled X-Atlassian-Jira-Url/X-Atlassian-Confluence-Url header hostnames and resolves DNS once, returning only a pass/fail verdict rather than a pinned IP. The Jira/Confluence fetchers then independently re-resolve the raw hostname at actual connection time, so a DNS-rebinding attacker can serve a safe public IP during validation and switch the DNS record to 169.254.169.254 or an internal RFC1918 address for the real connection. Entry point is any unauthenticated or low-privilege client able to set these HTTP headers when calling the MCP server; the attacker gains SSRF into cloud metadata (potentially exposing cloud IAM credentials) or internal services otherwise unreachable. This crosses a trust boundary specific to agentic tool servers: the MCP server acts as a confused deputy performing network requests on behalf of the calling agent/LLM, so a compromised or malicious upstream agent request can pivot into the hosting cloud environment.
Affected Systems
MCP Atlassian; protocols: MCP
Detection Signatures
- Requests to MCP Atlassian server containing X-Atlassian-Jira-Url or X-Atlassian-Confluence-Url headers with hostnames whose DNS records change rapidly between resolutions (low TTL, multiple A records alternating public/private ranges)
- Outbound connections from the MCP server process to 169.254.169.254 or RFC1918 ranges not part of normal Jira/Confluence deployment
- Log correlation showing validate_url_for_ssrf pass followed by a fetcher-layer connection to a different IP than the one validated
- Unexpected DNS queries with very low TTL (e.g., 0-5s) resolving to alternating public/internal addresses
Remediation Steps
- 1
Upgrade to fixed version
Update MCP Atlassian to version 0.22.0 or later, which addresses the SSRF validation gap.
- 2
Pin resolved IP at validation time
Ensure validate_url_for_ssrf resolves the hostname once and returns a pinned IP address that is used directly for the outbound connection (with SNI/Host header set appropriately), preventing re-resolution.
- 3
Block metadata and internal ranges at network layer
Apply egress filtering/firewall rules on the MCP server host to deny outbound traffic to 169.254.169.254 and private IP ranges regardless of application-layer checks.
- 4
Disable or restrict IMDSv1 and require IMDSv2/hop-limit
On cloud deployments, enforce IMDSv2 with token requirements and reduced hop limits to reduce metadata SSRF impact.
- 5
Restrict trust in client-supplied headers
Do not allow arbitrary client-controlled Jira/Confluence base URL headers to drive server-side network calls without strict allow-listing of known-good domains.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.