CVE-2026-42864

FireFighter (incident management) is vulnerable to unauthenticated SSRF via POST /api/v2/firefighter/raid/jira_bot (CreateJiraBotView). Before version 0.0.54, the endpoint allows any caller to trigger server-side fetching of attachments with httpx.get() and no URL validation, uploading the respon...