CVE-2026-42864

{
  "id": "CVE-2026-42864",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-11T19:16:24.417",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable without authentication (permission_classes = [permissions.AllowAny]). Its attachments payload is fetched server-side via httpx.get() with no URL validation, then uploaded as an attachment on the Jira ticket that gets created. An unauthenticated caller able to reach the ingress can coerce the pod into fetching arbitrary URLs and exfiltrate the response as a Jira attachment. On EC2/EKS deployments that do not enforce IMDSv2, this allows theft of the temporary AWS credentials attached to the pod's IAM role. The docstring on the view claims a Bearer token is required, but the code does not enforce it. This vulnerability is fixed in 0.0.54."
    },
    {
      "lang": "es",
      "value": "FireFighter es una aplicación de gestión de incidentes. Antes de la versión 0.0.54, el endpoint POST /api/v2/firefighter/raid/jira_bot (CreateJiraBotView) es accesible sin autenticación (permission_classes = [permissions.AllowAny]). Su carga útil de adjuntos se obtiene del lado del servidor a través de httpx.get() sin validación de URL, luego se carga como un adjunto en el ticket de Jira que se crea. Un llamador no autenticado capaz de alcanzar el ingreso puede forzar al pod a obtener URLs arbitrarias y exfiltrar la respuesta como un adjunto de Jira. En despliegues de EC2/EKS que no aplican IMDSv2, esto permite el robo de las credenciales temporales de AWS adjuntas al rol de IAM del pod. El docstring en la vista afirma que se requiere un token Bearer, pero el código no lo aplica. Esta vulnerabilidad está corregida en la versión 0.0.54."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ManoManoTech",
          "product": "firefighter-incident",
          "versions": [
            {
              "version": "< 0.0.54",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.3
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-11T19:34:04.380041Z",
          "id": "CVE-2026-42864",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ManoManoTech/firefighter-incident/security/advisories/GHSA-fqvv-jvhr-g5jc",
      "source": "[email protected]"
    }
  ]
}