CVE-2026-54637: Dragonfly Dragonfly scheduler unauthenticated SSRF in DownloadTinyFile

CVE-2026-54637 · Severity: medium · CVSS 4 · Published 2026-09-15

Dragonfly is an open-source P2P-based file distribution system. A security flaw in its scheduler component allows an unauthenticated attacker to force the system to make requests to internal network addresses that should be private. This could allow an attacker to scan internal infrastructure or steal small amounts of sensitive data from internal services, such as cloud metadata or local administrative interfaces.

Technologies: d7y.io/dragonfly/v2 (Go). Vendors: Go.

Quick answers

Is CVE-2026-54637 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54637 being exploited in the wild.
How severe is CVE-2026-54637?
Medium severity, with a CVSS score of 4, published 15 September 2026.
Which products and versions are affected?
d7y.io/dragonfly/v2 (Go) <= 2.4.4-rc.2, SEMVER:introduced=0,fixed=2.4.4-rc.3.
Is there a fix for CVE-2026-54637?
Yes. d7y.io/dragonfly/v2 (Go): upgrade to 2.4.4-rc.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54637 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54637?
Check whether you run d7y.io/dragonfly/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • d7y.io/dragonfly/v2 (Go): upgrade to 2.4.4-rc.3 or later
    go get d7y.io/dragonfly/v2@v2.4.4-rc.3

Technical details

The Dragonfly scheduler exposes a v1 gRPC service that, by default, lacks authentication and TLS. An attacker can invoke 'RegisterPeerTask' and 'ReportPeerResult' with a crafted 'PeerHost' message containing arbitrary IP addresses and ports (>= 1024). When the scheduler processes a 'TINY' task, it calls 'DownloadTinyFile', which uses a bare 'http.Transport' to fetch data from the attacker-supplied IP without validating if the destination is a global unicast address. This allows for read-SSRF against loopback (127.0.0.1), link-local (169.254.0.0/16), and RFC1918 addresses. The fetched content (up to 128 bytes) is stored in 'Task.DirectPiece' and can be exfiltrated by other peers. The vulnerability is fixed in version 2.4.4-rc.3 by implementing a safe dialer that rejects non-global-unicast destinations.

Affected products

  • dragonflyoss dragonfly <= 2.4.4-rc.2

Identifiers

  • CVE-2026-54637
  • GHSA-chwm-m7g7-685g
  • GO-2026-5910

Timeline

  • 2026-06-08: disclosed
  • 2026-07-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.