# CVE-2025-59345: GO-2025-3965 - Dragonfly doesn't have authentication enabled for some Manager’s endpoints in d7y.io/dragonfly

Source: https://junglewise.ai/threats/cve-2025-59345-dragonfly-doesn-t-have-authentication-enabled-for-some-manager-s  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-24  
License: CC BY 4.0 with a link back

CVE-2025-59345 · Severity: medium · CVSS 4 · Published 2025-09-24

Dragonfly doesn't have authentication enabled for some Manager’s endpoints in d7y.io/dragonfly

Technologies: [d7y.io/dragonfly/v2 (Go)](https://junglewise.ai/threats/technologies/d7y-io-dragonfly-v2), [github.com/dragonflyoss/dragonfly (Go)](https://junglewise.ai/threats/technologies/github-com-dragonflyoss-dragonfly). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2025-59345 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-59345 being exploited in the wild.

**How severe is CVE-2025-59345?** Medium severity, with a CVSS score of 4, published 24 September 2025.

**Which products and versions are affected?** d7y.io/dragonfly/v2 (Go) SEMVER:introduced=0,fixed=2.1.0; github.com/dragonflyoss/dragonfly (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.1.0.

**Is there a fix for CVE-2025-59345?** Yes. d7y.io/dragonfly/v2 (Go): upgrade to 2.1.0 or later; github.com/dragonflyoss/dragonfly (Go): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-59345?** Check whether you run d7y.io/dragonfly/v2 (Go) or github.com/dragonflyoss/dragonfly (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- d7y.io/dragonfly/v2 (Go): upgrade to 2.1.0 or later

  ```sh
  go get d7y.io/dragonfly/v2@v2.1.0
  ```

- github.com/dragonflyoss/dragonfly (Go): upgrade to 2.1.0 or later

  ```sh
  go get github.com/dragonflyoss/dragonfly@v2.1.0
  ```


## Affected products

- d7y.io/dragonfly/v2 (Go) SEMVER:introduced=0,fixed=2.1.0
- github.com/dragonflyoss/dragonfly (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.1.0

## Identifiers

- CVE-2025-59345
- GHSA-89vc-vf32-ch59
- GO-2025-3965

## Related threats

- [Dragonfly Dragonfly scheduler unauthenticated SSRF in DownloadTinyFile](https://junglewise.ai/threats/cve-2026-54637-dragonfly-dragonfly-scheduler-unauthenticated-ssrf-in)
- [Dragonfly Manager OAuth client_secret disclosure in API](https://junglewise.ai/threats/cve-2026-49254-dragonfly-manager-oauth-client-secret-disclosure-in-api)
- [GO-2026-4356 - Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2026-24124-dragonfly-manager-job-api-unauthenticated-access)
- [GO-2025-3972 - Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59350-dragonfly-vulnerable-to-timing-attacks-against-proxy-s-basic)
- [GO-2025-3968 - Dragonfly vulnerable to server-side request forgery in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59346-dragonfly-vulnerable-to-server-side-request-forgery)