Dragonfly Manager Job API Allows Unauthenticated Access
Priority MEDIUM 48CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.
Summary
Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with access to the Manager API to view, update and delete jobs. The issue is fixed in version 2.4.1-rc.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00782 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed dragonfly (dragonflyoss): 2.4.1-rc.1d7y.io/dragonfly/v2 (Go): 2.4.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | dragonfly | before 2.4.1-rc.1 | 2.4.1-rc.1 | Patch available | CNA |
| — | d7y.io/dragonfly/v2 (Go) | before 2.4.1 | 2.4.1 | Patch available | GHSA-j8hf-cp34-g4j7 |
- dragonfly Vendorbackstage Affected before 2.4.1-rc.1 Fixed in 2.4.1-rc.1 Patch available CNA
- d7y.io/dragonfly/v2 (Go) Vendor— Affected before 2.4.1 Fixed in 2.4.1 Patch available GHSA-j8hf-cp34-g4j7
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:linuxfoundation:dragonfly:*:*:*:*:*:go:*:* | before 2.4.1 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:dragonfly:2.4.1:beta0:*:*:*:go:*:* | 2.4.1 beta0 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:dragonfly:2.4.1:beta1:*:*:*:go:*:* | 2.4.1 beta1 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:dragonfly:2.4.1:rc0:*:*:*:go:*:* | 2.4.1 rc0 | Vulnerable | backstage |
- cpe:2.3:a:linuxfoundation:dragonfly:*:*:*:*:*:go:*:* Versions before 2.4.1 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:dragonfly:2.4.1:beta0:*:*:*:go:*:* Versions 2.4.1 beta0 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:dragonfly:2.4.1:beta1:*:*:*:go:*:* Versions 2.4.1 beta1 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:dragonfly:2.4.1:rc0:*:*:*:go:*:* Versions 2.4.1 rc0 Vulnerable ·backstage
Remediation
- Fix · CNA dragonfly (dragonflyoss) Fixed in 2.4.1-rc.1
- Fix · GHSA-j8hf-cp34-g4j7 d7y.io/dragonfly/v2 (Go) Fixed in 2.4.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-24124
- 2026-10-03 Alias added: GHSA-j8hf-cp34-g4j7
References
More backstage Dragonfly vulnerabilities
- TI-2023-12294 Dragonfly2 vulnerable to hard coded cyptographic key CVSS 3.1CRITICAL 9.8
- TI-2025-36909 Dragonfly incorrectly handles a task structure’s usedTraffic field CVSS 4.0MEDIUM 5.5
- TI-2025-36907 Dragonfly server-side request forgery vulnerability CVSS 4.0MEDIUM 5.5
- TI-2025-36908 Dragonfly Manager makes requests to external endpoints with disabled TLS authentication CVSS 4.0LOW 2.7
- TI-2025-36906 Dragonfly did not enable authentication for some Manager’s endpoints CVSS 4.0HIGH 7.7
- TI-2025-36914 Manager generates mTLS certificates for arbitrary IP addresses CVSS 4.0HIGH 7.7
Sources
- CVE-2026-24124 · CVE Program
- CVE-2026-24124 · NVD
- FIRST EPSS
- GHSA-j8hf-cp34-g4j7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences