CVE-2026-82443

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user...

CVE-2026-77274

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validateurlforssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL...

CVE-2026-77267

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by processauthenticationheaders and used to construct Atlassian fetchers without calling...

CVE-2026-77261

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, makessrfsafehook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauthpat branches. If an attacker-controlled or compromised configured...

CVE-2026-77265

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, header-supplied Jira or Confluence URLs are resolved and validated before the HTTP client resolves the hostname again for the connection. An unauthenticated caller can use a...

CVE-2026-77242

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validateurlforssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when connecting. A caller can use a short-lived DNS answer that is publi...

CVE-2026-77261 MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, makessrfsafehook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauthpat branches. If an attacker-controlled or compromised configured...

CVE-2026-77261

The MCP Atlassian Model Context Protocol server (versions prior to 0.22.0 ) is vulnerable to Server-Side Request Forgery (SSRF) due to a missing _make_ssrf_safe_hook in the JiraFetcher and ConfluenceFetcher sessions. Specifically, sessions created via the basic-auth and oauth_pat branches can be ...

CVE-2026-77261 MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, makessrfsafehook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauthpat branches. If an attacker-controlled or compromised configured...

EUVD-2026-84631

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, makessrfsafehook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauthpat branches. If an attacker-controlled or compromised configured...

CVE-2026-77261 MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, makessrfsafehook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauthpat branches. If an attacker-controlled or compromised configured...

CVE-2026-77242

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 0.22.0 . The root cause is an incomplete fix for CVE-2026-27826 where the validate_url_for_ssrf function checks resolved addresses, but the underlying R...

CVE-2026-77242 MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validateurlforssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when connecting. A caller can use a short-lived DNS answer that is publi...

CVE-2026-77242 MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validateurlforssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when connecting. A caller can use a short-lived DNS answer that is publi...

EUVD-2026-84627

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validateurlforssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when connecting. A caller can use a short-lived DNS answer that is publi...

CVE-2026-77242 MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validateurlforssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when connecting. A caller can use a short-lived DNS answer that is publi...

CVE-2026-77267 mcp-atlassian has an incomplete SSRF remediation

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by processauthenticationheaders and used to construct Atlassian fetchers without calling...

CVE-2026-77267 mcp-atlassian has an incomplete SSRF remediation

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by processauthenticationheaders and used to construct Atlassian fetchers without calling...

CVE-2026-77267

The MCP Atlassian server (a Model Context Protocol server for Confluence and Jira) is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 0.22.0 . The root cause is that the _process_authentication_headers function processes X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url he...

EUVD-2026-84621

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by processauthenticationheaders and used to construct Atlassian fetchers without calling...