# CVE-2023-27584: GO-2024-3136 - Dragonfly2 has hard coded cyptographic key in d7y.io/dragonfly

Source: https://junglewise.ai/threats/cve-2023-27584-dragonfly2-has-hard-coded-cyptographic-key  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-09-26  
License: CC BY 4.0 with a link back

CVE-2023-27584 · Severity: low · CVSS 3.1 · Published 2024-09-26

Dragonfly2 has hard coded cyptographic key in d7y.io/dragonfly

Technologies: [d7y.io/dragonfly/v2 (Go)](https://junglewise.ai/threats/technologies/d7y-io-dragonfly-v2). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2023-27584 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-27584 being exploited in the wild.

**How severe is CVE-2023-27584?** Low severity, with a CVSS score of 3.1, published 26 September 2024.

**Which products and versions are affected?** d7y.io/dragonfly/v2 (Go) SEMVER:introduced=0,fixed=2.1.0-beta.1, SEMVER:introduced=2.1.0-alpha.0,fixed=2.1.0-beta.1.

**Is there a fix for CVE-2023-27584?** Yes. d7y.io/dragonfly/v2 (Go): upgrade to 2.1.0-beta.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2023-27584?** Check whether you run d7y.io/dragonfly/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- d7y.io/dragonfly/v2 (Go): upgrade to 2.1.0-beta.1 or later

  ```sh
  go get d7y.io/dragonfly/v2@v2.1.0-beta.1
  ```


## Affected products

- d7y.io/dragonfly/v2 (Go) SEMVER:introduced=0,fixed=2.1.0-beta.1, SEMVER:introduced=2.1.0-alpha.0,fixed=2.1.0-beta.1

## Identifiers

- CVE-2023-27584
- GHSA-hpc8-7wpm-889w
- GO-2024-3136

## Related threats

- [Dragonfly Dragonfly scheduler unauthenticated SSRF in DownloadTinyFile](https://junglewise.ai/threats/cve-2026-54637-dragonfly-dragonfly-scheduler-unauthenticated-ssrf-in)
- [Dragonfly Manager OAuth client_secret disclosure in API](https://junglewise.ai/threats/cve-2026-49254-dragonfly-manager-oauth-client-secret-disclosure-in-api)
- [GO-2026-4356 - Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2026-24124-dragonfly-manager-job-api-unauthenticated-access)
- [GO-2025-3972 - Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59350-dragonfly-vulnerable-to-timing-attacks-against-proxy-s-basic)
- [GO-2025-3968 - Dragonfly vulnerable to server-side request forgery in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59346-dragonfly-vulnerable-to-server-side-request-forgery)