PT-2026-37285 · Unknown · Firefighter

Nicolas Lafitte · Published 2026-05-05 · Updated 2026-05-11 · CVE-2026-42864

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions FireFighter versions prior to 0.0.54

Description The 'POST /api/v2/firefighter/raid/jira bot' endpoint (CreateJiraBotView) is accessible without authentication. The attachments payload is processed via httpx.get() without URL validation, allowing an unauthenticated caller to force the server to fetch arbitrary URLs and exfiltrate the response as a Jira attachment. This Server-Side Request Forgery (SSRF)—a flaw where a server is coerced into making unintended requests—can be used on EC2/EKS deployments not enforcing IMDSv2 to steal temporary AWS credentials attached to the pod's IAM role.

Recommendations Update to version 0.0.54. Restrict ingress access to the 'POST /api/v2/firefighter/raid/jira bot' endpoint to trusted networks only. Rotate or revoke the Jira API token configured as RAID JIRA API PASSWORD as an emergency measure. Enforce IMDSv2 with HttpPutResponseHopLimit=1 on EC2/EKS nodes to prevent IAM credential theft.

Fix

Missing Authentication

SSRF

Weakness Enumeration

CWE-306

CWE-918

Related Identifiers

CVE-2026-42864

GHSA-FQVV-JVHR-G5JC

Affected Products

Firefighter

References · 7

• https://osv.dev/vulnerability/GHSA-fqvv-jvhr-g5jc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42864 · Security Note
• https://github.com/ManoManoTech/firefighter-incident/security/advisories/GHSA-fqvv-jvhr-g5jc · Note
• https://github.com/ManoManoTech/firefighter-incident/commit/2586679e6f32c12d223668b73e98f4c4de7b771f · Note
• https://github.com/ManoManoTech/firefighter-incident · Note
• https://twitter.com/0x2ed3bb60/status/2053919030390689892 · Twitter Post
• https://twitter.com/CVEnew/status/2053932385134383549 · Twitter Post