CVE-2026-49254: Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GE

Executive brief

Dragonfly Manager, a component used for managing P2P content distribution, contains a security flaw that allows anyone with network access to view sensitive OAuth credentials. These credentials, specifically the 'client_secret' for GitHub or Google integrations, are intended to be private. If an attacker obtains these secrets, they could potentially impersonate the application to perform unauthorized actions or launch phishing attacks against the organization's users.

Technical details

The Dragonfly Manager API fails to apply authentication and authorization middleware (JWT and RBAC) to the GET methods of the /api/v1/oauth and /api/v1/oauth/:id endpoints. Consequently, the application serializes the entire Oauth database model into the JSON response, including the 'client_secret' field which lacks a 'json:"-"' tag. An unauthenticated remote attacker can exploit this to retrieve sensitive credentials for configured OAuth providers like GitHub or Google. This vulnerability was addressed in version 2.4.4 by applying the necessary middleware to the route group and excluding the secret field from JSON serialization.

Affected products

• DragonflyOSS Dragonfly Manager <= 2.4.3

Timeline

• 2026-06-09: disclosed: Initial disclosure on GitHub Advisory Database
• 2026-07-02: advisory: Advisory updated and published

References

• https://api.github.com/users/tonghuaroot
• https://github.com/tonghuaroot
• https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D
• https://api.github.com/users/tonghuaroot/repos
• https://avatars.githubusercontent.com/u/23011166?v=4
• https://api.github.com/users/tonghuaroot/events%7B/privacy%7D