---
id: 3823
title: "[CVE-2026-27826] Otto Support - SSRF and Token Passthrough with MCP"
cve: CVE-2026-27826
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/otto-support-ssrf-token-passthrough-with-mcp"
published_at: "2026-05-07 00:00"
tags: ["ai-security", "cloud", "rce", "mcp", "ssrf", "token-passthrough", "cve-2026-27826", "markitdown"]
phying_url: "https://phying.com/item/3823"
lang: en
---

# [CVE-2026-27826] Otto Support - SSRF and Token Passthrough with MCP

## Summary

SSRF and token passthrough in MCP servers: the mcp-atlassian SSRF-to-RCE chain (CVE-2026-27826), MarkItDown's SSRF, and an OpenClaw marketplace plugin flaw show why destination validation matters.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **CVE:** CVE-2026-27826
- **Published:** 2026-05-07 00:00
- **Original:** https://bishopfox.com/blog/otto-support-ssrf-token-passthrough-with-mcp
- **Phying News:** https://phying.com/item/3823