Executive brief
Dragonfly doesn't have authentication enabled for some Manager’s endpoints in d7y.io/dragonfly
Affected products
- Go github.com/dragonflyoss/dragonfly
- Go d7y.io/dragonfly/v2
Junglewise Threat Intelligence
CVE-2025-59345: GO-2025-3965 - Dragonfly doesn't have authentication enabled for some Manager’s endpoints in d7y.io/dragonfly
CVE-2025-59345 · Severity: medium · CVSS 4 · Published 2025-09-24
Technologies: github.com/dragonflyoss/dragonfly (Go), d7y.io/dragonfly/v2 (Go). Vendors: Go.
Related threats
- Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthen
- Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GE
- GO-2026-4356 - Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly
- GO-2025-3972 - Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly
- GO-2025-3968 - Dragonfly vulnerable to server-side request forgery in d7y.io/dragonfly