p PatchFirst

PatchFirst · Latest vulnerabilities

firefighter-incident vulnerabilities

Vulnerabilities published for firefighter-incident in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2026-42864

    Critical · CVSS 9.9EPSS 0.27%Fix available

    FireFighter: Unauthenticated SSRF in Raid jira_bot endpoint allows IAM credential theft

    FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable without authentication (permission_classes = [permissions.AllowAny]). Its attachments payload is fetched server-side via httpx.get() with no URL validation, then uploaded as an attachment on the Jira ticket that gets created. An unauthenticated caller able to reach the ingress can coerce the pod into fetching arbitrary URLs and exfiltrate the response as a Jira attachment. On EC2/EKS deployments that do not enforce IMDSv2, this allows theft of the temporary AWS credentials attached to the pod

    firefighter-incidentPython
    • Update to 0.0.54
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →