Forms API requests under PAT/Basic used a less restricted HTTP client than OAuth. Entry and authority. The MCP tool invokes Jira Forms API using personal access token or Basic authentication. Observed mechanism and consequence. A bare requests.request followed upstream redirects without hardened DNS pinning; 0.24.1 aligns the transport. Limits and status.…
Inspect the ClaimsCase · DiggingBeagle record
MCP Atlassian Jira Forms PAT requests bypassed hardened SSRF handling
Forms API requests under PAT/Basic used a less restricted HTTP client than OAuth.
Public disclosure: Nov 8, 2026
Scope
The MCP tool invokes Jira Forms API using personal access token or Basic authentication. A bare requests.request followed upstream redirects without hardened DNS pinning; 0.24.1 aligns the transport.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-GHSA-PWX2-X8G8-PRVM; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-ATL-GHSA-PWX2-X8G8-PRVM-01 · CLM-DB233-ATL-GHSA-PWX2-X8G8-PRVM-02 · mcp-atlassian advisory GHSA-pwx2-x8g8-prvm
At a glance
Untrusted redirect precondition; no field compromise established.
Limits and uncertaintyFull account
Forms API requests under PAT/Basic used a less restricted HTTP client than OAuth.
Entry and authority. The MCP tool invokes Jira Forms API using personal access token or Basic authentication.
Observed mechanism and consequence. A bare requests.request followed upstream redirects without hardened DNS pinning; 0.24.1 aligns the transport.
Limits and status. Untrusted redirect precondition; no field compromise established.
The Jira Forms implementation had separate OAuth and PAT/Basic request branches. The hardened session and redirect checks covered one branch, while the others called an unprotected HTTP request path. An attacker-controlled Forms endpoint or redirect could therefore reach a destination that the stronger branch would have blocked. Whether secret-bearing headers survive any particular redirect is a separate client behavior to verify.
Mechanism and trust boundary
- 01
Precondition and trust context
The MCP tool invokes Jira Forms API using personal access token or Basic authentication.
- 02
Crossed boundary
A bare requests.request followed upstream redirects without hardened DNS pinning; 0.24.1 aligns the transport.
- 03
Observed limit
Untrusted redirect precondition; no field compromise established.
Timeline
- Nov 8, 2026Event type unspecified
Initial documented finding
MCP Atlassian Jira Forms PAT requests bypassed hardened SSRF handling
- Nov 8, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-ATL-GHSA-PWX2-X8G8-PRVM-01The GHSA-pwx2-x8g8-prvm advisory documents that a bare requests.request followed upstream redirects without hardened DNS pinning; 0.24.1 aligns the transport.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-pwx2-x8g8-prvmprimary disclosure
Advisory: Summary and Details
CLM-DB233-ATL-GHSA-PWX2-X8G8-PRVM-02The disclosed precondition is: The MCP tool invokes Jira Forms API using personal access token or Basic authentication.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-pwx2-x8g8-prvmprimary disclosure
Advisory: Affected configurations and reproduction
Controls and mitigations
- Route every Forms authentication mode through the same hardened SSRF-aware session; the advisory identifies version 0.24.1.
- Test redirects, DNS rebinding and Authorization forwarding for OAuth, PAT and Basic modes independently.
Unknowns and contradictions
- Untrusted redirect precondition; no field compromise established.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235