What’s Vulnerable › Products

dragonflyoss dragonfly vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Check whether your dragonflyoss dragonfly version is affected

Latest dragonflyoss dragonfly vulnerabilities

• CVE-2026-54637 — Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile (CVSS 5.5)
• CVE-2026-49254 — Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth (CVSS 2.9)
• CVE-2026-24124 — Dragonfly Manager Job API Allows Unauthenticated Access (CVSS 9.8)
• CVE-2025-59410 — Dragonfly tiny file download uses hard coded HTTP protocol (CVSS 3.7)
• CVE-2025-59354 — Dragonfly has weak integrity checks for downloaded files (CVSS 5.3)
• CVE-2025-59353 — Manager generates mTLS certificates for arbitrary IP addresses (CVSS 7.5)
• CVE-2025-59352 — Dragonfly allows arbitrary file read and write on a peer machine (CVSS 9.8)
• CVE-2025-59351 — Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error (CVSS 5.3)
• CVE-2025-59350 — Timing attacks against Proxy’s basic authentication are possible (CVSS 5.3)
• CVE-2025-59349 — Directories created via os.MkdirAll are not checked for permissions (CVSS 3.3)
• CVE-2025-59348 — Dragonfly incorrectly handles a task structure’s usedTraffic field (CVSS 7.5)
• CVE-2025-59347 — Dragonfly Manager makes requests to external endpoints with disabled TLS authentication (CVSS 6.5)
• CVE-2025-59346 — Dragonfly server-side request forgery vulnerability (CVSS 5.3)
• CVE-2025-59345 — Dragonfly did not enable authentication for some Manager’s endpoints (CVSS 9.1)
• CVE-2023-27584 — Dragonfly2 vulnerable to hard coded cyptographic key (CVSS 9.8)