The application tunnels you linked to are implemented using secure WebSocket protocols. This means there is an encrypted connection between Jira Cloud and Bitbucket, but that connection cannot be used directly to access other systems within your network. If Bitbucket has behaviors that allows lateral movement, that's another story.
"What happens if the Jira Cloud account gets hacked?"
The compromised account could be used to perform authorized operations, which could range from viewing dashboards or issues to administering the Atlassian Cloud account, depending on the permissions of the compromised account. A compromised account would be a very bad thing for a variety of reasons, application link or otherwise. I don't think it poses a serious risk to your internal network.
If someone manages to get access to the underlying host operating system, a WebSocket wouldn't benefit them significantly since it's in the "application layer" at both ends.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.