8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24124

CVE-2026-24124: Dragonfly Manager Job API Allows Unauthenticated Access

Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with access to the Manager API to view, update and delete jobs. The issue is fixed in version 2.4.1-rc.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24124

CVE-2026-24124:

8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
d7y.io/dragonfly/v2	go	< 2.4.0	2.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic case of missing authentication for critical functions. The manager/router/router.go file in the Dragonfly Manager component defines the REST API routes. The routes under /api/v1/jobs are set up without any authentication middleware, such as JWT or RBAC checks. This oversight allows any unauthenticated user to perform create, read, update, and delete (CRUD) operations on jobs. The vulnerable functions are the handlers associated with these unprotected routes. The fix involves adding the jwt.MiddlewareFunc() and rbac middleware to the apiv1.Group("/jobs", ...) definition, which enforces authentication and authorization for all job-related endpoints.

Vulnerable functions

d7y.io/dragonfly/v2/manager/handlers.CreateJob

manager/router/router.go

This function is the handler for the `POST /api/v1/jobs` endpoint, which is used to create new jobs. The vulnerability exists because the route is not protected by any authentication middleware, allowing unauthenticated users to create jobs.

d7y.io/dragonfly/v2/manager/handlers.DestroyJob

manager/router/router.go

This function is the handler for the `DELETE /api/v1/jobs/:id` endpoint, which is used to delete jobs. The vulnerability exists because the route is not protected by any authentication middleware, allowing unauthenticated users to delete jobs.

d7y.io/dragonfly/v2/manager/handlers.UpdateJob

manager/router/router.go

This function is the handler for the `PATCH /api/v1/jobs/:id` endpoint, which is used to modify jobs. The vulnerability exists because the route is not protected by any authentication middleware, allowing unauthenticated users to modify jobs.

d7y.io/dragonfly/v2/manager/handlers.GetJob

manager/router/router.go

This function is the handler for the `GET /api/v1/jobs/:id` endpoint, which is used to query job details. The vulnerability exists because the route is not protected by any authentication middleware, allowing unauthenticated users to query job details.

d7y.io/dragonfly/v2/manager/handlers.GetJobs

manager/router/router.go

This function is the handler for the `GET /api/v1/jobs` endpoint, which is used to list all jobs. The vulnerability exists because the route is not protected by any authentication middleware, allowing unauthenticated users to list all jobs.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.