Untrusted headers could bypass the HTTP gate and redirect service requests. Entry and authority. Shared HTTP transport accepts client-supplied Atlassian service URL and token headers. Observed mechanism and consequence. Middleware treated nonempty headers as authentication, then could make off-origin requests with forwarded credentials. Version 0.24.1…
Inspect the ClaimsCase · DiggingBeagle record
MCP Atlassian HTTP authentication trusted caller-supplied URL and token headers
Untrusted headers could bypass the HTTP gate and redirect service requests.
Public disclosure: Nov 8, 2026
Scope
Shared HTTP transport accepts client-supplied Atlassian service URL and token headers. Middleware treated nonempty headers as authentication, then could make off-origin requests with forwarded credentials. Version 0.24.1 ties origins to trusted configuration.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-GHSA-RH5V-38GG-Q3JJ; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-ATL-GHSA-RH5V-38GG-Q3JJ-01 · CLM-DB233-ATL-GHSA-RH5V-38GG-Q3JJ-02 · mcp-atlassian advisory GHSA-rh5v-38gg-q3jj
At a glance
Controlled requests, not verified credential theft or production access.
Limits and uncertaintyFull account
Untrusted headers could bypass the HTTP gate and redirect service requests.
Entry and authority. Shared HTTP transport accepts client-supplied Atlassian service URL and token headers.
Observed mechanism and consequence. Middleware treated nonempty headers as authentication, then could make off-origin requests with forwarded credentials. Version 0.24.1 ties origins to trusted configuration.
Limits and status. Controlled requests, not verified credential theft or production access.
In multi-user HTTP transport, the presence of caller-supplied Atlassian URL and personal-token headers was treated as proof of authentication. The same values also influenced where subsequent requests were sent, with a possible second step of forwarding configured headers beyond the trusted origin. A client-supplied token is not proof that the caller is an authorized MCP principal, and reported mock requests do not establish a real victim leak.
Mechanism and trust boundary
- 01
Precondition and trust context
Shared HTTP transport accepts client-supplied Atlassian service URL and token headers.
- 02
Crossed boundary
Middleware treated nonempty headers as authentication, then could make off-origin requests with forwarded credentials. Version 0.24.1 ties origins to trusted configuration.
- 03
Observed limit
Controlled requests, not verified credential theft or production access.
Timeline
- Nov 8, 2026Event type unspecified
Initial documented finding
MCP Atlassian HTTP authentication trusted caller-supplied URL and token headers
- Nov 8, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-ATL-GHSA-RH5V-38GG-Q3JJ-01The GHSA-rh5v-38gg-q3jj advisory documents that middleware treated nonempty headers as authentication, then could make off-origin requests with forwarded credentials. Version 0.24.1 ties origins to trusted configuration.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-rh5v-38gg-q3jjprimary disclosure
Advisory: Summary and Details
CLM-DB233-ATL-GHSA-RH5V-38GG-Q3JJ-02The disclosed precondition is: Shared HTTP transport accepts client-supplied Atlassian service URL and token headers.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-rh5v-38gg-q3jjprimary disclosure
Advisory: Affected configurations and reproduction
Controls and mitigations
- Require server-side request authentication independent of Atlassian configuration headers and pin operator-approved destinations; upgrade to 0.24.1.
- Discard caller-provided outbound origin overrides and avoid forwarding sensitive credentials across host boundaries.
Unknowns and contradictions
- Controlled requests, not verified credential theft or production access.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235