# d7y.io/dragonfly/v2 (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/d7y-io-dragonfly-v2 Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/d7y-io-dragonfly-v2.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 15 vulnerabilities in d7y.io/dragonfly/v2 (Go): 0 in the last 7 days and 2 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-54637, was published on 15 September 2026. Nothing in the last four weeks, down from 2 vulnerabilities in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 2 - All time: 15 (0 critical, 0 exploited in the wild) ## About d7y.io/dragonfly/v2 (Go) An open-source P2P-based image and asset distribution system. ## Latest d7y.io/dragonfly/v2 (Go) vulnerabilities - [CVE-2026-54637: Dragonfly Dragonfly scheduler unauthenticated SSRF in DownloadTinyFile](https://junglewise.ai/threats/cve-2026-54637-dragonfly-dragonfly-scheduler-unauthenticated-ssrf-in) (medium, CVSS 4, published 15 Sep 2026) - [CVE-2026-49254: Dragonfly Manager OAuth client_secret disclosure in API](https://junglewise.ai/threats/cve-2026-49254-dragonfly-manager-oauth-client-secret-disclosure-in-api) (medium, CVSS 4, published 15 Sep 2026) - [CVE-2026-24124: GO-2026-4356 - Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2026-24124-dragonfly-manager-job-api-unauthenticated-access) (medium, CVSS 4, published 2 Feb 2026) - [CVE-2025-59353: GO-2025-3969 - DragonFly's manager generates mTLS certificates for arbitrary IP addresses in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59353-dragonfly-s-manager-generates-mtls-certificates-for-arbitrary-ip) (medium, CVSS 4, published 24 Sep 2025) - [CVE-2025-59354: GO-2025-3973 - DragonFly has weak integrity checks for downloaded files in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59354-dragonfly-has-weak-integrity-checks-for-downloaded-files) (medium, CVSS 4, published 24 Sep 2025) - [CVE-2025-59351: DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error](https://junglewise.ai/threats/cve-2025-59351-dragonfly-vulnerable-to-panics-due-to-nil-pointer-dereference) (medium, CVSS 4, published 24 Sep 2025) - [CVE-2025-59347: GO-2025-3966 - Dragonfly's manager makes requests to external endpoints with disabled TLS authentication in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59347-dragonfly-s-manager-makes-requests-to-external-endpoints-with) (medium, CVSS 4, published 24 Sep 2025) - [CVE-2025-59349: GO-2025-3964 - Dragonfly's directories created via os.MkdirAll are not checked for permissions in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59349-dragonfly-s-directories-created-via-os-mkdirall-are-not-checked) (medium, CVSS 4, published 24 Sep 2025) - [CVE-2025-59348: GO-2025-3963 - Dragonfly incorrectly handles a task structure’s usedTrac field in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59348-dragonfly-incorrectly-handles-a-task-structure-s-usedtrac-field) (medium, CVSS 4, published 24 Sep 2025) - [CVE-2025-59352: GO-2025-3971 - DragonFly vulnerable to arbitrary file read and write on a peer machine in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59352-dragonfly-vulnerable-to-arbitrary-file-read-and-write-on-a-peer) (medium, CVSS 4, published 24 Sep 2025) - [CVE-2025-59410: GO-2025-3974 - DragonFly's tiny file download uses hard coded HTTP protocol in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59410-dragonfly-s-tiny-file-download-uses-hard-coded-http-protocol) (low, CVSS 3.1, published 24 Sep 2025) - [CVE-2025-59345: GO-2025-3965 - Dragonfly doesn't have authentication enabled for some Manager’s endpoints in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59345-dragonfly-doesn-t-have-authentication-enabled-for-some-manager-s) (medium, CVSS 4, published 24 Sep 2025) - [CVE-2025-59350: GO-2025-3972 - Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59350-dragonfly-vulnerable-to-timing-attacks-against-proxy-s-basic) (medium, CVSS 4, published 24 Sep 2025) - [CVE-2025-59346: GO-2025-3968 - Dragonfly vulnerable to server-side request forgery in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59346-dragonfly-vulnerable-to-server-side-request-forgery) (medium, CVSS 4, published 24 Sep 2025) - [CVE-2023-27584: GO-2024-3136 - Dragonfly2 has hard coded cyptographic key in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2023-27584-dragonfly2-has-hard-coded-cyptographic-key) (low, CVSS 3.1, published 26 Sep 2024) ## Most severe d7y.io/dragonfly/v2 (Go) vulnerabilities - [CVE-2026-54637: Dragonfly Dragonfly scheduler unauthenticated SSRF in DownloadTinyFile](https://junglewise.ai/threats/cve-2026-54637-dragonfly-dragonfly-scheduler-unauthenticated-ssrf-in) (medium, CVSS 4, published 15 Sep 2026) - [CVE-2026-24124: GO-2026-4356 - Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2026-24124-dragonfly-manager-job-api-unauthenticated-access) (medium, CVSS 4, published 2 Feb 2026) - [CVE-2025-59352: GO-2025-3971 - DragonFly vulnerable to arbitrary file read and write on a peer machine in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59352-dragonfly-vulnerable-to-arbitrary-file-read-and-write-on-a-peer) (medium, CVSS 4, published 24 Sep 2025) - [CVE-2026-49254: Dragonfly Manager OAuth client_secret disclosure in API](https://junglewise.ai/threats/cve-2026-49254-dragonfly-manager-oauth-client-secret-disclosure-in-api) (medium, CVSS 4, published 15 Sep 2026) - [CVE-2025-59345: GO-2025-3965 - Dragonfly doesn't have authentication enabled for some Manager’s endpoints in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59345-dragonfly-doesn-t-have-authentication-enabled-for-some-manager-s) (medium, CVSS 4, published 24 Sep 2025) - [CVE-2025-59348: GO-2025-3963 - Dragonfly incorrectly handles a task structure’s usedTrac field in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59348-dragonfly-incorrectly-handles-a-task-structure-s-usedtrac-field) (medium, CVSS 4, published 24 Sep 2025) - [CVE-2025-59350: GO-2025-3972 - Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59350-dragonfly-vulnerable-to-timing-attacks-against-proxy-s-basic) (medium, CVSS 4, published 24 Sep 2025) - [CVE-2025-59351: DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error](https://junglewise.ai/threats/cve-2025-59351-dragonfly-vulnerable-to-panics-due-to-nil-pointer-dereference) (medium, CVSS 4, published 24 Sep 2025) - [CVE-2025-59346: GO-2025-3968 - Dragonfly vulnerable to server-side request forgery in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59346-dragonfly-vulnerable-to-server-side-request-forgery) (medium, CVSS 4, published 24 Sep 2025) - [CVE-2025-59353: GO-2025-3969 - DragonFly's manager generates mTLS certificates for arbitrary IP addresses in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59353-dragonfly-s-manager-generates-mtls-certificates-for-arbitrary-ip) (medium, CVSS 4, published 24 Sep 2025) ## Vulnerabilities per week Nothing in the last four weeks, down from 2 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "d7y.io/dragonfly/v2 (Go) vulnerabilities", https://junglewise.ai/threats/technologies/d7y-io-dragonfly-v2, 13 November 2026.