An unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the Firefighter incident project in the POST /api/v2/firefighter/raid/jira_bot endpoint. This endpoint allows unauthenticated users to submit attachments URLs that the server fetches without validation, enabling attackers to coerce the server into fetching arbitrary URLs, including the AWS EC2 metadata service. This can lead to theft of temporary AWS IAM credentials on EC2/EKS deployments that do not enforce IMDSv2. The vulnerability is fixed in version 0.0.54 by enforcing authentication and validating attachment URLs.