CVE-2026-42864: FireFighter: Missing Authentication in Jira Bot Endpoint (CWE-306)

Overview

FireFighter is an incident management application. According to the advisory record, a Jira bot endpoint (CreateJiraBotView) can be reached without authentication in versions before 0.0.54. Its attachment handling fetches remote URLs from the server without validation and uploads the result to a newly created Jira ticket. Primary reference: GitHub Security Advisory GHSA-fqvv-jvhr-g5jc.

Impact

Missing authentication: the endpoint permits anonymous callers, and the code does not enforce the Bearer token that the view docstring describes.
Server-side fetching: the server can be induced to request arbitrary URLs, which is a request-forgery pattern (our classification, not stated in the record).
Data exposure: responses from fetched URLs can be stored as Jira attachments, where the caller may read them.
Cloud credentials: on EC2 or EKS deployments that do not enforce the instance metadata session-token requirement, temporary IAM role credentials of the pod may be exposed. The record states this outcome.

The record assigns CWE-306 (Missing Authentication for Critical Function) and a CVSS 3.1 base score of 9.9 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L.

Affected products and versions

FireFighter, versions prior to 0.0.54: described as affected by the advisory text.
The structured affected and fixes fields in the record are empty, so the exact version range and any backported fixes for older branches are not confirmed by the structured data.

Exploitation status

The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability in the record is 0.0045. Active exploitation should not be assumed, but exposed deployments deserve prompt attention because the flaw requires no credentials.

Remediation and mitigation

Upgrade: update FireFighter to version 0.0.54 or later, as stated in the record.
Restrict access: limit network reachability of the Jira bot endpoint to trusted sources until the upgrade is complete.
Harden instance metadata: enforce session-token requirements for instance metadata on EC2 nodes and review EKS node configuration.
Reduce role scope: keep the IAM role attached to the pod to the minimum permissions required.
Constrain egress: restrict outbound HTTP from application pods to what the workload needs.

Detection guidance

Review web or ingress logs for unauthenticated requests to the Jira bot route and correlate them with new Jira tickets that carry unexpected attachments.
Monitor for unusual outbound requests from FireFighter pods to internal metadata addresses or unfamiliar external hosts.
Audit recent use of the pod IAM role for activity from unexpected sources or addresses.

Limitations of the available information

The record does not identify all affected version ranges, and the structured affected list is empty.
Whether the fix in 0.0.54 includes a full authentication check or only the URL handling change is unknown from the record.
The NVD and CVE Program pages were listed as sources, but their detailed content was not included in the record.
The record shows a source status of Deferred, so further updates may follow.
EPSS and CVSS data come from the record as provided, and may change over time.

Frequently asked questions

Is this CVE being actively exploited?

The record shows this CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. Organizations should still patch promptly because no credentials are required to reach the endpoint.

Which version fixes the issue?

The advisory text in the record states the vulnerability is fixed in version 0.0.54. Versions before 0.0.54 are described as affected.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.