Executive brief
Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly
Affected products
- Go d7y.io/dragonfly/v2
Junglewise Threat Intelligence
CVE-2026-24124: GO-2026-4356 - Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly
CVE-2026-24124 · Severity: medium · CVSS 4 · Published 2026-02-02
Technologies: d7y.io/dragonfly/v2 (Go). Vendors: Go.
Related threats
- Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthen
- Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GE
- GO-2025-3972 - Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly
- GO-2025-3968 - Dragonfly vulnerable to server-side request forgery in d7y.io/dragonfly
- GO-2025-3969 - DragonFly's manager generates mTLS certificates for arbitrary IP addresses in d7y.io/dragonfly