A proxy could resolve a caller-controlled hostname after a local address check. Entry and authority. HTTP proxy is enabled and the attacker influences Atlassian service URL configuration. Observed mechanism and consequence. Local validation/pinning was undermined when a proxy re-resolved a trusted hostname; 0.24.1 constrains the trusted origin. Limits…
Inspect the ClaimsCase · DiggingBeagle record
MCP Atlassian SSRF DNS pinning failed across an HTTP proxy
A proxy could resolve a caller-controlled hostname after a local address check.
Public disclosure: Nov 8, 2026
Scope
HTTP proxy is enabled and the attacker influences Atlassian service URL configuration. Local validation/pinning was undermined when a proxy re-resolved a trusted hostname; 0.24.1 constrains the trusted origin.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-GHSA-3C6H-QWX8-HJCM; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-ATL-GHSA-3C6H-QWX8-HJCM-01 · CLM-DB233-ATL-GHSA-3C6H-QWX8-HJCM-02 · mcp-atlassian advisory GHSA-3c6h-qwx8-hjcm
At a glance
Requires this proxy configuration; no observed cloud metadata disclosure.
Limits and uncertaintyFull account
A proxy could resolve a caller-controlled hostname after a local address check.
Entry and authority. HTTP proxy is enabled and the attacker influences Atlassian service URL configuration.
Observed mechanism and consequence. Local validation/pinning was undermined when a proxy re-resolved a trusted hostname; 0.24.1 constrains the trusted origin.
Limits and status. Requires this proxy configuration; no observed cloud metadata disclosure.
The pinning layer initially classified a hostname as safe, but an operator-configured proxy could conduct another DNS lookup at request time. Where an attacker could select the Atlassian service URL, the final address might differ from the address that had passed local scrutiny. This is conditional on both URL control and proxy resolution; it is not evidence of a successful cloud-metadata compromise.
Mechanism and trust boundary
- 01
Precondition and trust context
HTTP proxy is enabled and the attacker influences Atlassian service URL configuration.
- 02
Crossed boundary
Local validation/pinning was undermined when a proxy re-resolved a trusted hostname; 0.24.1 constrains the trusted origin.
- 03
Observed limit
Requires this proxy configuration; no observed cloud metadata disclosure.
Timeline
- Nov 8, 2026Event type unspecified
Initial documented finding
MCP Atlassian SSRF DNS pinning failed across an HTTP proxy
- Nov 8, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-ATL-GHSA-3C6H-QWX8-HJCM-01The GHSA-3c6h-qwx8-hjcm advisory documents that local validation/pinning was undermined when a proxy re-resolved a trusted hostname; 0.24.1 constrains the trusted origin.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-3c6h-qwx8-hjcmprimary disclosure
Advisory: Summary and Details
CLM-DB233-ATL-GHSA-3C6H-QWX8-HJCM-02The disclosed precondition is: HTTP proxy is enabled and the attacker influences Atlassian service URL configuration.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-3c6h-qwx8-hjcmprimary disclosure
Advisory: Affected configurations and reproduction
Controls and mitigations
- Restrict Jira and Confluence service origins to operator-approved hosts and maintain outbound address policy across proxy resolution; use the reported 0.24.1 correction.
- Check resolved destinations and redirects at the network egress boundary, not only before constructing a proxied request.
Unknowns and contradictions
- Requires this proxy configuration; no observed cloud metadata disclosure.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235