Skip to content
OpenAdvisories

Vendor

dragonflyoss

15 known vulnerabilities.

Products

dragonfly 14 Dragonfly2 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.9
    CVE-2026-24124

    Dragonfly Manager Job API Allows Unauthenticated Access

    Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This a…

    dragonflyoss dragonfly d7y.io/dragonfly/v2 Go
  • High 7.7
    CVE-2025-59353

    Manager generates mTLS certificates for arbitrary IP addresses

    Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager’s…

    dragonflyoss dragonfly d7y.io/dragonfly/v2 github.com/dragonflyoss/dragonfly Go
  • High 7.7
    CVE-2025-59345

    Dragonfly did not enable authentication for some Manager’s endpoints

    Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs and /preheats endpoints in Manager web UI are accessible without authentication. Any user with network access to the Manager can create, de…

    dragonflyoss dragonfly d7y.io/dragonfly/v2 github.com/dragonflyoss/dragonfly Go