CVE-2026-19369 | KS-GEN-AI jira-mcp-server 0.2.0 add_attachment_from_public_url src/index.ts axios.get imageUrl server-side request forgery (EUVD-2026-54953)

A vulnerability described as critical has been identified in KS-GEN-AI jira-mcp-server 0.2.0. This affects the function axios.get of the file src/index.ts of the component add_attachment_from_public_url. The manipulation of the argument imageUrl results in server-side request forgery. This vulnerability is reported as CVE-2026-19369. The attack requires a local approach. Moreover, an exploit is present. The project was informed of the problem early through an issue report but has not responded yet.