The FireFighter incident management application exposes the POST /api/v2/firefighter/raid/jira_bot endpoint to unauthenticated requests due to a permission_classes setting of AllowAny. An attacker can supply an arbitrary URL in the attachment payload; the server fetches that URL using httpx.get() without validation and then uploads the response as a Jira attachment. This Server Side Request Forgery flaw allows an attacker to coerce the pod into retrieving data from any reachable location, including AWS’s instance metadata service, thereby exfiltrating temporary IAM credentials if IMDSv2 is not enforced.

The vulnerability affects ManoManoTech firefFighter-incident versions earlier than 0.0.54. It is relevant for deployments on EC2 or EKS where the pod is granted an IAM role and available to external traffic without authentication.

The CVSS score of 9.9 marks the flaw as critical. EPSS data is not provided, but the lack of authentication combined with SSRF makes exploitation straightforward for any actor who can reach the public ingress. The flaw could lead to the compromise of temporary AWS credentials, granting full access to the associated IAM role – a serious impact on confidentiality, integrity, and availability. The vulnerability is not listed in the CISA KEV catalog.