What is the CVSS score of CVE-2026-42864?

CVE-2026-42864 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Atlassian are affected by CVE-2026-42864?

The firefighter-incident Python package contains a critical server-side request forgery vulnerability that allows unauthenticated attackers to exfiltrate AWS IAM credentials from EC2 instance…. A patch is available.

How to fix or mitigate CVE-2026-42864?

Within 24 hours: Identify all deployments of firefighter-incident package and confirm current version; immediately restrict network access to the `/api/v2/firefighter/raid/jira_bot` endpoint via WAF or firewall rules. Within 7 days: Apply vendor patch to version 0.0.54 or later across all affected systems; validate patch deployment and confirm authentication enforcement on the vulnerable endpoint. Within 30 days: Conduct credential audit to identify any AWS IAM credentials that may have been accessed via metadata endpoint; rotate all credentials in affected EC2 instances; implement network segmentation to restrict metadata service access only to authorized processes.

Atlassian CVE-2026-42864

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-05-05 https://github.com/ManoManoTech/firefighter-incident

GHSA-fqvv-jvhr-g5jc

Authentication Bypass SSRF Atlassian

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

May 05, 2026 - 19:02 vuln.today

Analysis Generated

May 05, 2026 - 19:02 vuln.today

DescriptionGitHub Advisory

Impact

The POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable without authentication (permission_classes = [permissions.AllowAny]). Its attachments payload is fetched server-side via httpx.get() with no URL validation, then uploaded as an attachment on the Jira ticket that gets created.

An unauthenticated caller able to reach the ingress can coerce the pod into fetching arbitrary URLs - including the cloud metadata endpoint at http://169.254.169.254/ - and exfiltrate the response as a Jira attachment.

On EC2/EKS deployments that do not enforce IMDSv2, this allows theft of the temporary AWS credentials attached to the pod's IAM role. The docstring on the view claims a Bearer token is required, but the code does not enforce it.

Affected code paths:

src/firefighter/raid/views/__init__.py - CreateJiraBotView
src/firefighter/raid/serializers.py - LandbotIssueRequestSerializer.attachments
src/firefighter/raid/client.py - RaidJiraClient.add_attachments_to_issue

Patches

Fixed in firefighter-incident 0.0.54:

CreateJiraBotView now enforces BearerTokenAuthentication + IsAuthenticated.
attachments URLs are validated: http(s) scheme only, max 10 URLs, rejection

of any host resolving to a private, loopback, link-local, reserved, multicast or unspecified IP (IPv4 and IPv6).

Fixes an unrelated KeyError('attachments') surfaced during regression testing.

Users should upgrade to 0.0.54 or later.

Workarounds

Until upgrade is possible, any one of the following blocks end-to-end exploitation:

Restrict ingress access to /api/v2/firefighter/raid/jira_bot to trusted

networks only (VPN, internal load balancer).

Rotate or revoke the Jira API token configured as RAID_JIRA_API_PASSWORD;

this breaks jira.create_issue() before the vulnerable attachment fetch is reached (legitimate traffic is also blocked - emergency mitigation only).

Enforce IMDSv2 with HttpPutResponseHopLimit=1 on EC2/EKS nodes. This does

not fix the SSRF itself but neutralises the IAM-credential-theft path.

Resources

CWE-918: Server-Side Request Forgery
CWE-306: Missing Authentication for Critical Function

AnalysisAI

Server-side request forgery combined with missing authentication in firefighter-incident Python package allows unauthenticated remote attackers to exfiltrate AWS IAM credentials from cloud metadata endpoints. The /api/v2/firefighter/raid/jira_bot endpoint accepts arbitrary URLs in the attachments parameter, fetches them server-side without validation, and uploads responses as Jira attachments — enabling SSRF against internal services including http://169.254.169.254/ (AWS EC2 Instance Metadata Service). Vendor-released patch (version 0.0.54) enforces authentication and validates attachment URLs to block private/link-local/loopback addresses. No public exploit identified at time of analysis, but exploitation is trivial given detailed advisory with exact vulnerable code paths.