Read the docs
TI-2026-39466 Aliases CVE-2026-54637GHSA-chwm-m7g7-685g

Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

Priority MEDIUM 64CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort values through RegisterPeerTask and ReportPeerResult, storeHost copies those values into resource.Host, and handlePeerSuccess invokes Peer.DownloadTinyFile() for a TINY task. DownloadTinyFile() in scheduler/resource/standard/peer.go builds an HTTP GET request from the supplied address without destination validation, allowing a remote attacker to probe loopback, link-local, and private services and place up to TinyFileSize, 128 bytes, of a response in Task.DirectPiece for later retrieval. PeerHost.DownPort is restricted to ports 1024 through 65534, and the issue provides read SSRF rather than remote code execution. The remediation blocks loopback and link-local targets, while RFC1918 destinations remain reachable because IsGlobalUnicast accepts private ranges. This issue is fixed in 2.4.4-rc.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.008 56th percentileScored 2026-11-07
Fix Fixed dragonfly (dragonflyoss): 2.4.4-rc.3d7y.io/dragonfly/v2 (Go): 2.4.4-rc.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagedragonflybefore 2.4.4-rc.32.4.4-rc.3Patch availableCNA
—d7y.io/dragonfly/v2 (Go)before 2.4.4-rc.32.4.4-rc.3Patch availableGHSA-chwm-m7g7-685g
  • dragonfly Vendorbackstage Affected before 2.4.4-rc.3 Fixed in 2.4.4-rc.3 Patch available CNA
  • d7y.io/dragonfly/v2 (Go) Vendor— Affected before 2.4.4-rc.3 Fixed in 2.4.4-rc.3 Patch available GHSA-chwm-m7g7-685g

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:dragonfly:*:*:*:*:*:*:*:*——backstage
  • cpe:2.3:a:linuxfoundation:dragonfly:*:*:*:*:*:*:*:* Versions — — ·backstage

Remediation

  • Fix · CNA dragonfly (dragonflyoss) Fixed in 2.4.4-rc.3
  • Fix · GHSA-chwm-m7g7-685g d7y.io/dragonfly/v2 (Go) Fixed in 2.4.4-rc.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54637
  2. 2026-10-03 Alias added: GHSA-chwm-m7g7-685g

References

Other 13

  • TI-2026-33119 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys KEVCVSS 3.1CRITICAL 9.6
  • TI-2018-10499 Integer overflow in backstage kernel KEVCVSS 3.0HIGH 7.8
  • TI-2024-08998 Remote Code Execution in kedro-org/kedro CVSS 3.0CRITICAL 9.8
  • TI-2023-12294 Dragonfly2 vulnerable to hard coded cyptographic key CVSS 3.1CRITICAL 9.8
  • TI-2021-12074 Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via… CVSS 3.1CRITICAL 9.8
  • TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
See all 662 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences