Is CVE-2026-77261 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-77261?

CVE-2026-77261 has a CVSS v3 severity of HIGH (7.1).

Back

CVE-2026-77261

Description

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, _make_ssrf_safe_hook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauth_pat branches. If an attacker-controlled or compromised configured Atlassian instance returns a redirect to an internal address, those sessions can follow the redirect without revalidating its destination. This issue is fixed in version 0.22.0.