What’s Vulnerable › Vulnerabilities

CVE-2026-24124: Dragonfly Manager Job API Allows Unauthenticated Access

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-22 · updated 2026-06-17
• Weakness: CWE-306

Description

Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with access to the Manager API to view, update and delete jobs. The issue is fixed in version 2.4.1-rc.1.

Affected products

• dragonflyoss dragonfly: before 2.4.1; 2.4.1-beta0, 2.4.1-beta1, 2.4.1-rc0 — fixed in 2.4.1

How to fix

Upgrade to a fixed version: dragonflyoss dragonfly 2.4.1. Check the vendor advisory for mitigations.

References

• https://github.com/dragonflyoss/dragonfly/commit/9fb9a2dfde3100f32dc7f48eabee4c2b64eac55f
• https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-j8hf-cp34-g4j7

Get alerted when CVE-2026-24124 or the next vulnerability affects your stack