CVE-2026-42864 in firefighter-incident
Summary
by MITRE • 05/11/2026
FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable without authentication (permission_classes = [permissions.AllowAny]). Its attachments payload is fetched server-side via httpx.get() with no URL validation, then uploaded as an attachment on the Jira ticket that gets created. An unauthenticated caller able to reach the ingress can coerce the pod into fetching arbitrary URLs and exfiltrate the response as a Jira attachment. On EC2/EKS deployments that do not enforce IMDSv2, this allows theft of the temporary AWS credentials attached to the pod's IAM role. The docstring on the view claims a Bearer token is required, but the code does not enforce it. This vulnerability is fixed in 0.0.54.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/11/2026
The FireFighter incident management application contains a critical authentication bypass vulnerability in its Jira bot integration endpoint that exposes organizations to significant security risks. The vulnerability exists in the POST /api/v2/firefighter/raid/jira_bot endpoint which is configured with permission_classes = [permissions.AllowAny], meaning any unauthenticated user can access this functionality. This endpoint is designed to create Jira tickets with attachments, but the implementation fails to properly validate incoming requests despite the endpoint's docstring claiming to require a Bearer token for authentication. The flaw stems from the server-side processing of the attachments payload where httpx.get() is used to fetch content from URLs provided in the request without any validation or sanitization of the target URLs. This creates a server-side request forgery vulnerability that allows remote attackers to make the application's pod fetch arbitrary web resources and upload their contents as attachments to Jira tickets. The security implications escalate significantly when the application runs on EC2 or EKS environments that do not enforce IMDSv2, as attackers can leverage this vulnerability to extract temporary AWS credentials from the pod's IAM role through the EC2 metadata service. The vulnerability represents a direct violation of authentication and authorization controls, aligning with CWE-287 which addresses improper authentication issues, and provides an attack vector that maps to ATT&CK technique T1566.002 for server-side request forgery. Organizations using FireFighter versions prior to 0.0.54 face potential credential theft, unauthorized access to cloud resources, and compromise of the application's integration with Jira systems. The fix in version 0.0.54 addresses both the authentication bypass by properly enforcing token validation and the SSRF vulnerability by implementing proper URL validation and sanitization of the attachment payloads. This vulnerability demonstrates the critical importance of proper authentication enforcement and input validation in API endpoints that interact with external systems, particularly when those endpoints handle sensitive credential material or facilitate integration with privileged services. The flaw also highlights the risks associated with misconfigured permissions and the dangers of relying on documentation that does not match actual implementation, as the endpoint's docstring misleadingly indicated authentication requirements that were not actually enforced in code.