https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T03:41:58.922260+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-270924 EUVD-2026-270924 2026-10-06T03:41:58.971133+00:00 EUVD-2026-270924 https://cve.radiocsirt.org/vuln/fkie_cve-2026-24124 fkie_cve-2026-24124 2026-10-06T03:41:58.971203+00:00

Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with access to the Manager API to view, update and delete jobs. The issue is fixed in version 2.4.1-rc.1.

 https://cve.radiocsirt.org/vuln/ghsa-j8hf-cp34-g4j7 GHSA-j8hf-cp34-g4j7 — Dragonfly Manager Job API Unauthenticated Access 2026-10-06T03:41:58.971283+00:00

Affected: Go: d7y.io/dragonfly/v2

## Summary

Dragonfly Manager's Job REST API endpoints lack authentication, allowing unauthenticated attackers to create, query, modify, and delete jobs, potentially leading to resource exhaustion, information disclosure, and service disruption.

## Affected Products

- **Product**: Dragonfly - **Component**: Manager (REST API) - **Affected Versions**: v2.x (based on source code analysis, including v2.4.0) - **Affected Endpoints**: `/api/v1/jobs`

## Vulnerability Details

### Description

Dragonfly Manager's Job API endpoints (`/api/v1/jobs`) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with access to the Manager API to perform the following operations:

1. **List all jobs** (GET `/api/v1/jobs`) 2. **Create new jobs** (POST `/api/v1/jobs`) 3. **Query job details** (GET `/api/v1/jobs/:id`) 4. **Modify jobs** (PATCH `/api/v1/jobs/:id`) 5. **Delete jobs** (DELETE `/api/v1/jobs/:id`)

### Technical Root Cause

In the source code file `manager/router/router.go` at lines 204-211, the Job API route group lacks authentication middleware:

```go // TODO Add auth to the following routes and fix the tests. // Job. job := apiv1.Group("/jobs") job.POST("", middlewares.CreateJobRateLimiter(limiter), h.CreateJob) job.DELETE(":id", h.DestroyJob) job.PATCH(":id", h.UpdateJob) job.GET(":id", h.GetJob) job.GET("", h.GetJobs) ```

In contrast, other API endpoints (such as `/clusters`) are correctly configure…