CVE-2026-24124

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24124", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-21T18:38:22.473Z", "datePublished": "2026-01-22T22:20:20.820Z", "dateUpdated": "2026-02-26T14:44:30.933Z"}, "containers": {"cna": {"title": "Dragonfly Manager Job API Allows Unauthenticated Access", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.9, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-j8hf-cp34-g4j7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-j8hf-cp34-g4j7"}, {"name": "https://github.com/dragonflyoss/dragonfly/commit/9fb9a2dfde3100f32dc7f48eabee4c2b64eac55f", "tags": ["x_refsource_MISC"], "url": "https://github.com/dragonflyoss/dragonfly/commit/9fb9a2dfde3100f32dc7f48eabee4c2b64eac55f"}], "affected": [{"vendor": "dragonflyoss", "product": "dragonfly", "versions": [{"version": "< 2.4.1-rc.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T22:20:20.820Z"}, "descriptions": [{"lang": "en", "value": "Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with access to the Manager API to view, update and delete jobs. The issue is fixed in version 2.4.1-rc.1."}], "source": {"advisory": "GHSA-j8hf-cp34-g4j7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24124", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-24T04:55:24.034473Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:44:30.933Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24124", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-24T04:55:24.034473Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T20:09:17.968Z"}}], "cna": {"title": "Dragonfly Manager Job API Allows Unauthenticated Access", "source": {"advisory": "GHSA-j8hf-cp34-g4j7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.9, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "dragonflyoss", "product": "dragonfly", "versions": [{"status": "affected", "version": "< 2.4.1-rc.1"}]}], "references": [{"url": "https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-j8hf-cp34-g4j7", "name": "https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-j8hf-cp34-g4j7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/dragonflyoss/dragonfly/commit/9fb9a2dfde3100f32dc7f48eabee4c2b64eac55f", "name": "https://github.com/dragonflyoss/dragonfly/commit/9fb9a2dfde3100f32dc7f48eabee4c2b64eac55f", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with access to the Manager API to view, update and delete jobs. The issue is fixed in version 2.4.1-rc.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T22:20:20.820Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24124", "state": "PUBLISHED", "dateUpdated": "2026-02-26T14:44:30.933Z", "dateReserved": "2026-01-21T18:38:22.473Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-22T22:20:20.820Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dragonfly", "vendor": "dragonflyoss", "versions": [{"status": "affected", "version": "< 2.4.1-rc.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:dragonfly:*:*:*:*:*:go:*:*", "matchCriteriaId": "8415ECC7-F04F-4D86-B1B1-63AA3947A69C", "versionEndExcluding": "2.4.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:dragonfly:2.4.1:beta0:*:*:*:go:*:*", "matchCriteriaId": "4CD047B6-68F7-4CC9-9561-A4D079103877", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:dragonfly:2.4.1:beta1:*:*:*:go:*:*", "matchCriteriaId": "51F51456-C6A6-49D3-AD56-E0910F0DFE14", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:dragonfly:2.4.1:rc0:*:*:*:go:*:*", "matchCriteriaId": "F7FE647B-92E9-460E-BC22-BCDBE9144730", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with access to the Manager API to view, update and delete jobs. The issue is fixed in version 2.4.1-rc.1."}, {"lang": "es", "value": "Dragonfly es un sistema de distribuci\u00f3n de archivos y aceleraci\u00f3n de im\u00e1genes basado en P2P de c\u00f3digo abierto. En las versiones 2.4.1-rc.0 e inferiores, los endpoints de la API de trabajos (/api/v1/jobs) carecen de middleware de autenticaci\u00f3n JWT y de comprobaciones de autorizaci\u00f3n RBAC en la configuraci\u00f3n de enrutamiento. Esto permite a cualquier usuario no autenticado con acceso a la API del Manager ver, actualizar y eliminar trabajos. El problema se ha corregido en la versi\u00f3n 2.4.1-rc.1."}], "id": "CVE-2026-24124", "lastModified": "2026-06-17T10:22:40.050", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.9, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24124", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-24T04:55:24.034473Z", "version": "2.0.3"}}]}, "published": "2026-01-22T23:15:58.153", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/dragonflyoss/dragonfly/commit/9fb9a2dfde3100f32dc7f48eabee4c2b64eac55f"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-j8hf-cp34-g4j7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T15:21:53.126624+00:00", "value": {"mitigation_remediation": ["Upgrade Dragonfly to version 2.4.1\u2011rc.1 or later to restore authentication and RBAC for the Job API endpoints.", "Restrict network access to the Manager API (e.g., via firewall rules or reverse\u2011proxy authentication) until the upgrade can be performed.", "Enable audit logging for job operations and monitor for unauthorized activity to detect exploitation attempts."], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated access to Dragonfly Job API allows privileged operations such as viewing, modifying, and deleting jobs."}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Dragonfly project from the Linux Foundation, specifically versions 2.4.1\u2011rc.0 and all earlier releases. The issue is resolved in release 2.4.1\u2011rc.1. No other product variants or platforms are listed as impacted.", "description_and_impact": "Dragonfly, an open source peer\u2011to\u2011peer file distribution and image acceleration system, exposes its Manager Job API endpoints (/api/v1/jobs) without JWT authentication middleware or role\u2011based access controls in versions 2.4.1\u2011rc.0 and earlier. This CWE\u2011306 Missing Authentication weakness means any network user who can reach the Manager API can list, modify, or delete jobs. The missing authentication allows an attacker to read job metadata, potentially revealing sensitive information, to inject malicious jobs that may disrupt distribution processes, or to delete jobs, causing denial of service for legitimate users.", "risk_and_exploitability": "The CVSS score of 8.9 indicates a high\u2011severity flaw, and the EPSS score of less than 1% suggests the probability of exploitation is currently low. The vulnerability is not present in the CISA KEV catalog. Based on the description, the likely attack vector is a network user with access to the Manager API endpoint, which can be reached over HTTP/HTTPS. Because the API does not enforce authentication or RBAC, an unauthenticated attacker can directly invoke the endpoints and perform privileged operations on jobs."}}}}, "created": "2026-01-23T10:27:24.375392+00:00", "updated": "2026-04-18T15:30:03.954737+00:00", "vendors": ["dragonflyoss", "dragonflyoss$PRODUCT$dragonfly2"]}