Skip to content
Hermes Codex

CVE-2026-27826: mcp-atlassian Unvalidated Header SSRF to Cloud Instance Metadata

HERMES

HERMES THREAT SCORE & MCP RISK EXPOSURE

Target: Model Context Protocol (MCP) Server & Atlassian Ecosystem Gateway
Confidence: 96%
88 / 100
HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 18 / 20
Threat Activity 19 / 20
Weaponization 20 / 20
Exposure 19 / 20
Prevalence 18 / 20
Impact 17 / 20
Exploit Maturity 20 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-27826 at 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N). Hermes Threat Score assigns 88 (HIGH) to capture the amplified blast radius of AI agent tool execution and direct file/network access.

HASS

HASS AGENTIC SEVERITY & TOOL EXECUTION IMPACT

Target: Autonomous LLM Agent Interface & Host Execution Boundary
Confidence: 92%
72 / 100
HIGH

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown
Autonomy 16 / 20
Tool Access 19 / 20
Privilege 17 / 15
Persistence 15 / 15
External Impact 18 / 15
Propagation 16 / 15
⚖️ Divergence & Operational Rationale

Agentic tool protocols like MCP grant language models direct access to host filesystems and cloud services. Vulnerabilities in MCP tool endpoints allow indirect prompt injections to achieve arbitrary host compromise.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-27826: mcp-atlassian Unvalidated Header SSRF to Cloud Instance MetadataVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ affectsPRODUCTLangChain & LangGraph Framework
98% VERY_HIGH

Multi-agent coordination framework and cyclic state graph orchestration engine for tool-calling agents.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in LangGraph Multi-Agent Runtime documented in Hermes dossier.”

Supporting Verified Evidence:

1. Technical Context & Affected Software Matrix

Section titled “1. Technical Context & Affected Software Matrix”
ParameterSpecificationOperational Assessment
CVE IdentifierCVE-2026-27826Official Disclosure / Advisory
Affected Productsooperset/mcp-atlassianModel Context Protocol Server
Vulnerability ClassCWE-918Server-Side Request Forgery (SSRF)
Vulnerable ComponentHTTP Header URL DispatcherTool Execution & Dispatch Engine
Exploitation VectorRemote Network / Prompt InjectionHTTP SSE Endpoint or Agent stdio pipe
Privileges RequiredNone (PR:N)Unauthenticated direct invocation
Resulting AccessArbitrary Host File Access / SSRFFull read/write over local host files or cloud IAM
Remediation StatusFixed in version 0.17.0Immediate package update mandated

2. Vulnerability Anatomy & Root Cause Analysis

Section titled “2. Vulnerability Anatomy & Root Cause Analysis”

Code Dissection & Mechanism

Section titled “Code Dissection & Mechanism”

The flaw resides in HTTP Header URL Dispatcher. The server failed to enforce directory sandboxing via validate_safe_path() or strict authentication checks:

# Vulnerable pattern in mcp-atlassian (< 0.17.0)
def HTTP Header URL Dispatcher(file_path: str, **kwargs):
    # INSECURE: caller-supplied path is accessed without workspace boundary enforcement
    with open(file_path, "rb") as f:
        file_bytes = f.read()
    return client.upload(file_bytes)

In version 0.17.0, the maintainers introduced mandatory path verification:

# Remediated pattern in mcp-atlassian (0.17.0)
from mcp_atlassian.utils import validate_safe_path


def HTTP Header URL Dispatcher(file_path: str, **kwargs):
    safe_path = validate_safe_path(file_path, workspace_dir=CONFIG.WORKSPACE_ROOT)
    with open(safe_path, "rb") as f:
        file_bytes = f.read()
    return client.upload(file_bytes)

3. Attack Vectors & Exploitation Scenario

Section titled “3. Attack Vectors & Exploitation Scenario”
sequenceDiagram
    autonumber
    actor Attacker as Attacker / Adversarial Prompt
    participant Agent as LLM Agent (Claude/Cursor)
    participant MCP as mcp-atlassian Daemon
    participant Host as MCP Host OS Filesystem
    participant Atlassian as Jira / Confluence Cloud API


    Attacker->>Agent: Indirect Prompt Injection (Ticket / Repo)
    Agent->>MCP: tools/call HTTP Header URL Dispatcher(file_path="../../../../etc/passwd")
    Note over MCP: Vulnerability CVE-2026-27826:<br/>Missing Path Validation / Auth Bypass
    MCP->>Host: Access arbitrary host resource
    Host-->>MCP: Raw file data or execution pipe
    MCP->>Atlassian: Upload secret as attachment / Outbound Request
    Atlassian-->>Attacker: Sensitive Data Disclosed
  1. Adversarial Ingress: The attacker feeds a poisoned prompt into an issue ticket or source file consumed by an autonomous AI agent.
  2. Agentic Tool Invocation: The LLM agent generates a JSON-RPC tools/call invoking HTTP Header URL Dispatcher with a malicious argument.
  3. Boundary Transgression: Due to CVE-2026-27826, the MCP server performs the operation outside the designated workspace sandbox.
  4. Data Exfiltration: Host secrets, SSH keys, or cloud credentials are uploaded into Atlassian or returned in tool results.

4. Detection Engineering & Threat Hunting

Section titled “4. Detection Engineering & Threat Hunting”
alert http any any -> any any (
  msg:"HERMES-CODEX EXPLOIT mcp-atlassian CVE-2026-27826 Attack Attempt";
  flow:to_server,established;
  content:"POST"; http_method;
  content:"/mcp/tools/call"; http_uri;
  content:"HTTP Header URL Dispatcher"; nocase;
  content:"../";
  classtype:attempted-admin;
  sid:20260021;
  rev:1;
  metadata:cve CVE-2026-27826, severity high;
)

5. Remediation & Defense Playbook

Section titled “5. Remediation & Defense Playbook”
  1. Immediate Package Upgrade: Upgrade mcp-atlassian to version 0.17.0 or higher:
    Terminal window
    pip install --upgrade "mcp-atlassian>=0.17.0"
  2. Local Loopback Binding: Restrict the HTTP/SSE listener strictly to 127.0.0.1:
    Terminal window
    python -m mcp_atlassian.server --host 127.0.0.1 --port 8000
  3. Workspace Isolation: Set MCP_WORKSPACE_DIR to confine all file reads/writes to a dedicated sandbox.
  4. Tool Whitelisting: Disable attachment manipulation tools if unneeded using ENABLED_TOOLS or TOOLSETS.

Related Threat Intelligence & References

Section titled “Related Threat Intelligence & References”