A transition-format IPv6 destination obscured an internal IPv4 address from the allow/deny classifier. Entry and authority. An affected MCP service permits attacker-influenced URLs and has a functioning NAT64 gateway. Observed mechanism and consequence. The SSRF filter assessed 64:ff9b::/96 as global without decoding embedded private IPv4; 0.24.1 adds…
Inspect the ClaimsCase · DiggingBeagle record
MCP Atlassian NAT64 IPv6 allowed an internal IPv4 destination past SSRF checks
A transition-format IPv6 destination obscured an internal IPv4 address from the allow/deny classifier.
Public disclosure: Nov 8, 2026
Scope
An affected MCP service permits attacker-influenced URLs and has a functioning NAT64 gateway. The SSRF filter assessed 64:ff9b::/96 as global without decoding embedded private IPv4; 0.24.1 adds this check.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-GHSA-85P8-F4J5-J5JP; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-ATL-GHSA-85P8-F4J5-J5JP-01 · CLM-DB233-ATL-GHSA-85P8-F4J5-J5JP-02 · mcp-atlassian advisory GHSA-85p8-f4j5-j5jp
At a glance
The route needs actual NAT64 translation; no proven live metadata theft.
Limits and uncertaintyFull account
A transition-format IPv6 destination obscured an internal IPv4 address from the allow/deny classifier.
Entry and authority. An affected MCP service permits attacker-influenced URLs and has a functioning NAT64 gateway.
Observed mechanism and consequence. The SSRF filter assessed 64:ff9b::/96 as global without decoding embedded private IPv4; 0.24.1 adds this check.
Limits and status. The route needs actual NAT64 translation; no proven live metadata theft.
The standard NAT64 translation prefix encodes an IPv4 destination inside an IPv6 address. An address policy that checks only native IPv6 classification can therefore accept a path that reaches a private or link-local IPv4 endpoint after translation. This requires a network that actually performs the translation; string classification alone does not show that cloud credentials were fetched.
Mechanism and trust boundary
- 01
Precondition and trust context
An affected MCP service permits attacker-influenced URLs and has a functioning NAT64 gateway.
- 02
Crossed boundary
The SSRF filter assessed 64:ff9b::/96 as global without decoding embedded private IPv4; 0.24.1 adds this check.
- 03
Observed limit
The route needs actual NAT64 translation; no proven live metadata theft.
Timeline
- Nov 8, 2026Event type unspecified
Initial documented finding
MCP Atlassian NAT64 IPv6 allowed an internal IPv4 destination past SSRF checks
- Nov 8, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-ATL-GHSA-85P8-F4J5-J5JP-01The GHSA-85p8-f4j5-j5jp advisory documents that the SSRF filter assessed 64:ff9b::/96 as global without decoding embedded private IPv4; 0.24.1 adds this check.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-85p8-f4j5-j5jpprimary disclosure
Advisory: Summary and Details
CLM-DB233-ATL-GHSA-85P8-F4J5-J5JP-02The disclosed precondition is: An affected MCP service permits attacker-influenced URLs and has a functioning NAT64 gateway.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-85p8-f4j5-j5jpprimary disclosure
Advisory: Affected configurations and reproduction
Controls and mitigations
- Decode recognized NAT64-mapped destinations and enforce the embedded IPv4 restrictions; the published correction is in 0.24.1.
- Enforce outbound network ACLs independently of application URL checks and test IPv4, IPv6 and transition forms.
Unknowns and contradictions
- The route needs actual NAT64 translation; no proven live metadata theft.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235