Evidence · DiggingBeagle record
mcp-atlassian advisory GHSA-rh5v-38gg-q3jj
Original mcp-atlassian security advisory for mcp atlassian http authentication trusted caller-supplied url and token headers.
- Published
- Nov 8, 2026
- Source role
- primary disclosure
Evidence record
Original mcp-atlassian security advisory for mcp atlassian http authentication trusted caller-supplied url and token headers.
Claim-level citations (2)
- supportsMCP Atlassian HTTP authentication trusted caller-supplied URL and token headers: The GHSA-rh5v-38gg-q3jj advisory documents that middleware treated nonempty headers as authentication, then could make off-origin requests with forwarded credentials. Version 0.24.1 ties origins to trusted configuration.
Advisory: Summary and Details
- supportsMCP Atlassian HTTP authentication trusted caller-supplied URL and token headers: The disclosed precondition is: Shared HTTP transport accepts client-supplied Atlassian service URL and token headers.
Advisory: Affected configurations and reproduction