CVE-2026-19369 | KS-GEN-AI jira-mcp-server 0.2.0 add_attachment_from_public_url src/index.ts axios.get imageUrl server-side request forgery

A vulnerability described as critical has been identified in KS-GEN-AI jira-mcp-server 0.2.0. This affects the function axios.get of the file src/index.ts of the component add_attachment_from_public_url. The manipulation of the argument imageUrl results in server-side request forgery.

This vulnerability is reported as CVE-2026-19369. The attack requires a local approach. Moreover, an exploit is present.

The project was informed of the problem early through an issue report but has not responded yet.