CVE-2025-59345 Dragonfly did not enable authentication for some Manager’s endpoints
Unauthenticated attackers can access Manager endpoints to create or delete jobs, causing denial of service and data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-59345?
CVE-2025-59345 is a high-severity missing authorization vulnerability in dragonflyoss dragonfly, published on 17 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs and /preheats endpoints in Manager web UI are accessible without authentication. Any user with network access to the Manager can create, delete, and modify jobs, and create preheat jobs. An unauthenticated adversary with network access to a Manager web UI uses /api/v1/jobs endpoint to create hundreds of useless jobs. The Manager is in a denial-of-service state, and stops accepting requests from valid administrators. This vulnerability is fixed in 2.1.0.
Weakness: CWE-306
Which versions are affected by CVE-2025-59345?
6 open source packages ship an affected version, including github.com/dragonflyoss/dragonfly and d7y.io/dragonfly/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/dragonflyoss/dragonfly Go | All versions | None |
github.com/dragonflyoss/dragonfly Go | All versions | 2.1.0 |
github.com/dragonflyoss/dragonfly Go | All versions | 2.1.0 |
d7y.io/dragonfly/v2 Go | All versions | 2.1.0 |
d7y.io/dragonfly/v2 Go | All versions | 2.1.0 |
d7y.io/dragonfly/v2 Go | All versions | 2.1.0 |
Products include Linuxfoundation Dragonfly.
How do I fix CVE-2025-59345?
Upgrade github.com/dragonflyoss/dragonfly to 2.1.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-59345 being exploited?
There is no known exploitation of CVE-2025-59345 in the wild and no public exploit code.
Other vulnerabilities in dragonflyoss dragonfly
- CVE-2023-27584 Dragonfly2 vulnerable to hard coded cyptographic key
- CVE-2026-24124 Dragonfly Manager Job API Allows Unauthenticated Access
- CVE-2025-59353 Manager generates mTLS certificates for arbitrary IP addresses
- CVE-2025-59352 Dragonfly allows arbitrary file read and write on a peer machine
- CVE-2025-59346 Dragonfly server-side request forgery vulnerability
Sources
Also known as GHSA-89vc-vf32-ch59, GO-2025-3965.