dragonflyoss dragonfly

• CVE-2026-49254 Low 2.9 Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth 0.5%
• CVE-2026-54637 Medium 5.5 Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile 0.8%
• CVE-2026-24124 High 8.9 Dragonfly Manager Job API Allows Unauthenticated Access 0.8%
• CVE-2025-59410 Medium 5.5 Dragonfly tiny file download uses hard coded HTTP protocol 0.1%
• CVE-2025-59354 Medium 5.5 Dragonfly has weak integrity checks for downloaded files 0.2%
• CVE-2025-59353 High 7.7 Manager generates mTLS certificates for arbitrary IP addresses 0.2%
• CVE-2025-59352 Medium 6.9 Dragonfly allows arbitrary file read and write on a peer machine 0.7%
• CVE-2025-59351 Low 2.7 Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error 0.3%
• CVE-2025-59350 Low 2.7 Timing attacks against Proxy’s basic authentication are possible 0.3%
• CVE-2025-59349 Low 2.0 Directories created via os.MkdirAll are not checked for permissions 0.1%
• CVE-2025-59348 Medium 5.5 Dragonfly incorrectly handles a task structure’s usedTraffic field 0.4%
• CVE-2025-59347 Low 2.7 Dragonfly Manager makes requests to external endpoints with disabled TLS authentication 0.2%
• CVE-2025-59346 Medium 5.5 Dragonfly server-side request forgery vulnerability 0.2%
• CVE-2025-59345 High 7.7 Dragonfly did not enable authentication for some Manager’s endpoints 0.4%