EUVD-2026-270924

fkie_cve-2026-24124

Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with access to the Manager API to view, update and delete jobs. The issue is fixed in version 2.4.1-rc.1.

GHSA-j8hf-cp34-g4j7 — Dragonfly Manager Job API Unauthenticated Access

Affected: Go: d7y.io/dragonfly/v2

## Summary

Dragonfly Manager's Job REST API endpoints lack authentication, allowing unauthenticated attackers to create, query, modify, and delete jobs, potentially leading to resource exhaustion, information disclosure, and service disruption.

## Affected Products

- **Product**: Dragonfly - **Component**: Manager (REST API) - **Affected Versions**: v2.x (based on source code analysis, including v2.4.0) - **Affected Endpoints**: `/api/v1/jobs`

## Vulnerability Details

### Description

Dragonfly Manager's Job API endpoints (`/api/v1/jobs`) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with access to the Manager API to perform the following operations:

1. **List all jobs** (GET `/api/v1/jobs`) 2. **Create new jobs** (POST `/api/v1/jobs`) 3. **Query job details** (GET `/api/v1/jobs/:id`) 4. **Modify jobs** (PATCH `/api/v1/jobs/:id`) 5. **Delete jobs** (DELETE `/api/v1/jobs/:id`)

### Technical Root Cause

In the source code file `manager/router/router.go` at lines 204-211, the Job API route group lacks authentication middleware:

```go // TODO Add auth to the following routes and fix the tests. // Job. job := apiv1.Group("/jobs") job.POST("", middlewares.CreateJobRateLimiter(limiter), h.CreateJob) job.DELETE(":id", h.DestroyJob) job.PATCH(":id", h.UpdateJob) job.GET(":id", h.GetJob) job.GET("", h.GetJobs) ```

In contrast, other API endpoints (such as `/clusters`) are correctly configure…

Most recent entries from all

EUVD-2026-270924

fkie_cve-2026-24124

GHSA-j8hf-cp34-g4j7 — Dragonfly Manager Job API Unauthenticated Access