CVE-2026-42864
FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable without authentication (permission_classes =...
Affects 0 products across 1 vendor.
Software does not perform any authentication for functionality that requires a verified identity.
Attacker causes the server to make HTTP requests to attacker-chosen destinations, potentially reaching internal services.
Show all 6
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
FireFighter, an incident management application, prior to version 0.0.54, has an unauthenticated endpoint that allows attackers to upload malicious attachments to Jira tickets by exploiting a lack of URL validation.
BSID: BS-2026-GLOBAL-152903-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2026-42864?
What is the CVSS score for CVE-2026-42864?
Is CVE-2026-42864 actively exploited?
How do I remediate CVE-2026-42864?
What systems are affected by CVE-2026-42864?
| CVE ID | CVE-2026-42864 |
|---|---|
| BSID | BS-2026-GLOBAL-152903-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L |
| Published | 2026-05-11 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable without authentication (permission_classes = [permissions.AllowAny]). Its attachments payload is fetched server-side via httpx.get() with no URL validation, then uploaded as an attachment on the Jira ticket that gets created. An unauthenticated caller able to reach the ingress can coerce the pod into fetching arbitrary URLs and exfiltrate the response as a Jira attachment. On EC2/EKS deployments that do not enforce IMDSv2, this allows theft of the temporary AWS credentials attached to the pod's IAM role. The docstring on the view claims a Bearer token is required, but the code does not enforce it. This vulnerability is fixed in 0.0.54.
Source: NIST NVD / MITRE CVE Database
The vulnerability lies in the POST /api/v2/firefighter/raid/jira_bot endpoint, which is publicly accessible. Attackers can send a request with a malicious URL in the attachments payload, which the server fetches and uploads to a Jira ticket without any validation.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Enforce | — | — |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 1906363e5282852bb86202a44a2ae33217cdbb922c3efd9e0d231529b8004b750c677bd596a51b5cbc7ccf709fbbd8cda5944d821d02e89ac27ecb2c07c8e0c3 |
Critical Severity - Know Your Exposure
A CVSS 9.9 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →