CVE-2026-24124
Critical · 9.8CVSS
9.8
EPSS
0.8%
Published
Jan 22, 2026
CISA due date
—
The record
Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with access to the Manager API to view, update and delete jobs. The issue is fixed in version 2.4.1-rc.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | d7y.io/dragonfly/v2 | 0 | 2.4.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260205T172317-150000.1.146.1 |
Related vulnerabilities
- GO-2026-4356 Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly Same vulnerability
- CVE-2023-27584 Dragonfly2 has hard coded cyptographic key Also affects d7y.io/dragonfly/v2
- CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
- CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
- CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34042 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34040 Moby is an open source container framework. Also affects govulncheck-vulndb
- CVE-2026-33997 Moby is an open source container framework. Also affects govulncheck-vulndb