Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M
CVE-2026-49254Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth
Low 2.9
In plain English
A low-severity information exposure in dragonfly from dragonflyoss. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc() or RBAC(), while manager/handlers/oauth.go returns models.Oauth records and manager/models/oauth.go exposes Oauth.ClientSecret as client_secret in JSON. When an administrator has configured a GitHub or Google OAuth provider, an unauthenticated network client can reach GetOauth or GetOauths, load the stored models.Oauth record, and obtain the provider's client secret, client identifier, and redirect URL. The earlier GHSA-j8hf-cp34-g4j7 remediation protected the /jobs group only and did not protect these OAuth GET handlers. Disclosure of client_secret can enable abuse of the configured identity-provider integration, subject to the provider's redirect URI restrictions. This issue is fixed in 2.4.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | d7y.io/dragonfly/v2 | 2.4.4 | GHSA-4q9j-6299-gxmr |
| Go | d7y.io/dragonfly/v2 | 2.4.4 | GO-2026-5901 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| dragonflyoss | dragonfly | < 2.4.4 |
Weakness: CWE-200, CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P