FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft
The POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable without authentication (permission_classes = [permissions.AllowAny]). Its attachments payload is fetched server-side via httpx.get() with no URL validation, then uploaded as an attachment on the Jira ticket that gets created. An unauthenticated caller able to reach the ingress can coerce the pod into fetching arbitrary URLs — including the cloud metadata endpoint at http://169.254.169.254/ — and exfiltrate the response as a Jira attachment. On …