# Otto Support - SSRF and Token Passthrough with MCP

mcp-atlassian read unvalidated URL headers for upstream destinations, letting local-network attackers SSRF to exfiltrate AWS keys and SSH keys, chained with path traversal to RCE.

- Payout: Research
- Severity: critical
- Program: mcp-atlassian
- Found by (vendor credit): AntAISecurityLab
- Disclosed: 2026-05-07
- CVE: CVE-2026-27826, CVE-2026-27825, CVE-2026-41297
- Write-up quality: 6/10
- Original: https://bishopfox.com/blog/otto-support-ssrf-token-passthrough-with-mcp
- Library page: https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-otto-support-ssrf-token-passthrough-with-mcp
- Tags: area:ai domain:ai impact:data-leak impact:rce kind:research platform:research sev:critical tech:aws technique:chained vuln:auth-bypass vuln:path-traversal vuln:rce vuln:ssrf

**Target:** MCP server HTTP middleware and confluence_download_attachment tool
**Root cause:** HTTP middleware trusted X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers as upstream API destinations without URL validation, and the server bound to 0.0.0.0 with no authentication. A separate path traversal in confluence_download_attachment allowed writing outside the intended directory.
**Steps:**
1. Reach the MCP server on the local network (default bind 0.0.0.0, no auth).
2. Send a request with `X-Atlassian-Jira-Url` or `X-Atlassian-Confluence-Url` set to attacker-controlled infrastructure to redirect outbound requests (CVE-2026-27826).
3. Use the SSRF to exfiltrate local files such as AWS credentials, SSH keys, kubeconfig, and .env files.
4. Exploit path traversal in `confluence_download_attachment` (CVE-2026-27825) to write executable code to `~/.bashrc` or `~/Library/LaunchAgents/`.
5. Code executes on next shell invocation, yielding unauthenticated RCE.
**Exploitation:** Unauthenticated attacker on the same network injects malicious URLs via the Atlassian URL headers to redirect the server's outbound requests, exfiltrating developer secrets; the path traversal then plants code in shell startup or LaunchAgents for execution on next shell.
**Escalation:** SSRF for credential/file exfiltration chained with a path traversal write to ~/.bashrc or LaunchAgents to escalate to unauthenticated RCE.
**Insight:** MCP servers often resolve upstream destinations from client-supplied headers or URL parameters in middleware rather than tool handlers; audit header-driven base URLs and default 0.0.0.0 binds, and pair file-download tools with write-path traversal checks.

## Write-ups of the same bug (oldest first)
- 2026-03-10: [MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment](https://bugbountylibrary.com/r/ghsa%3AGHSA-xjgw-4wvw-rgm4) — yotampe-pluto, gil-maman-p
- 2026-03-10: [MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers](https://bugbountylibrary.com/r/ghsa%3AGHSA-7r34-79r5-rcc9) — yotampe-pluto, gil-maman-p
- 2026-05-07: [Otto Support - SSRF and Token Passthrough with MCP](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-otto-support-ssrf-token-passthrough-with-mcp) (this one)