FireFighter Unauthenticated SSRF AWS Credential Theft

Georg Lauenstein@gsec

•updated Jun 6, 2026•1•0•12

Detects exploitation of CVE-2026-42864, an unauthenticated SSRF in the FireFighter incident management application. Attackers can coerce the application to fetch arbitrary URLs, potentially exfiltrating AWS metadata credentials (IMDS) as Jira attachments.