CVE-2026-42864: FireFighter Auth Bypass Vulnerability

CVE-2026-42864 Overview

CVE-2026-42864 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in FireFighter, an incident management application maintained by ManoMano. The flaw resides in the POST /api/v2/firefighter/raid/jira_bot endpoint, implemented by the CreateJiraBotView class. The view declares permission_classes = [permissions.AllowAny], leaving it reachable without authentication despite a docstring stating that a Bearer token is required. The endpoint fetches attachment URLs server-side using httpx.get() without URL validation. The issue is fixed in version 0.0.54 and tracked as [CWE-306] Missing Authentication for Critical Function.

Critical Impact
On EC2 or EKS deployments without IMDSv2 enforcement, attackers can coerce the pod to query the instance metadata service and exfiltrate temporary AWS IAM credentials as Jira attachments.

Affected Products

ManoManoTech FireFighter incident management application
All versions prior to 0.0.54
Deployments exposing the /api/v2/firefighter/raid/jira_bot endpoint via ingress

Discovery Timeline

2026-05-11 - CVE-2026-42864 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42864

Vulnerability Analysis

The CreateJiraBotView accepts a JSON payload that includes an attachments field containing URLs. The view iterates over those URLs and retrieves them server-side using httpx.get() with no allowlist, scheme restriction, or destination filtering. After fetching the content, FireFighter attaches the response body to the Jira ticket it creates on behalf of the caller.

An unauthenticated attacker who can reach the ingress controller submits a crafted request specifying internal or metadata URLs in attachments. The pod fetches the URL, and the response is uploaded to Jira where the attacker can read it through the created ticket. This converts the endpoint into a read-capable SSRF proxy that bridges external attackers to internal network resources.

Root Cause

The root cause is broken access control combined with missing input validation. The view sets permission_classes = [permissions.AllowAny], which explicitly disables authentication. The documented Bearer token requirement was never enforced in code. Additionally, the attachments fetch path performs no URL validation against private IP ranges, link-local addresses, or non-HTTP schemes.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a POST request with a crafted JSON body referencing http://169.254.169.254/latest/meta-data/iam/security-credentials/ on AWS deployments without IMDSv2 enforcement. The pod returns temporary AWS credentials tied to the IAM role of the workload. The attacker then retrieves these credentials from the Jira attachment and pivots into the cloud account. The advisory describes the exploitation mechanics; see the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-42864

Indicators of Compromise

Inbound POST requests to /api/v2/firefighter/raid/jira_bot from unexpected source IPs or without a valid Bearer token
Outbound HTTP requests from FireFighter pods to 169.254.169.254, metadata.google.internal, or RFC1918 addresses
New Jira tickets created by the FireFighter service account with attachments containing IAM credential JSON or internal HTTP responses
AWS CloudTrail entries showing API calls from the pod's IAM role originating from external IP addresses

Detection Strategies

Inspect application access logs for requests to the jira_bot endpoint and correlate with downstream egress traffic
Alert on Jira ticket attachments whose content matches AWS credential patterns such as AccessKeyId, SecretAccessKey, or Token
Monitor Kubernetes pod egress for connections to cloud metadata IP addresses

Monitoring Recommendations

Enable VPC Flow Logs and CloudTrail data events on the EKS workload account
Forward FireFighter and ingress controller logs to a centralized analytics platform for query and retention
Track sts:GetCallerIdentity and credential-usage anomalies for the pod's IAM role

How to Mitigate CVE-2026-42864

Immediate Actions Required

Upgrade FireFighter to version 0.0.54 or later
Enforce IMDSv2 on all EC2 instances backing EKS node groups and set the hop limit to 1
Rotate any IAM credentials associated with the FireFighter pod's role if exposure is suspected
Restrict ingress access to the /api/v2/firefighter/raid/jira_bot route to trusted networks until patched

Patch Information

The vendor released a fix in FireFighter 0.0.54. The patch addresses the missing authentication on CreateJiraBotView and removes the unvalidated server-side fetch behavior. Refer to the GitHub Security Advisory GHSA-fqvv-jvhr-g5jc for the upstream commit and release notes.

Workarounds

Block the /api/v2/firefighter/raid/jira_bot path at the ingress or reverse proxy until the upgrade is applied
Apply a Kubernetes NetworkPolicy that denies egress from FireFighter pods to 169.254.169.254/32 and cloud metadata endpoints
Scope the pod's IAM role to the minimum permissions required and remove any unused privileges

bash

# Enforce IMDSv2 on existing EC2 instances backing EKS nodes
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled