CVE-2026-24124 Dragonfly Manager Job API Allows Unauthenticated Access

What is CVE-2026-24124?

CVE-2026-24124 is a high-severity missing authorization vulnerability in dragonflyoss dragonfly, published on 22 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with access to the Manager API to view, update and delete jobs. The issue is fixed in version 2.4.1-rc.1.

Weakness: CWE-306

Which versions are affected by CVE-2026-24124?

3 open source packages ship an affected version, including d7y.io/dragonfly/v2. It affects 1 product.

Products include Linuxfoundation Dragonfly.

How do I fix CVE-2026-24124?

Upgrade d7y.io/dragonfly/v2 to 2.4.1 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-24124 being exploited?

There is no known exploitation of CVE-2026-24124 in the wild and no public exploit code.

Other vulnerabilities in dragonflyoss dragonfly

• CVE-2023-27584 Dragonfly2 vulnerable to hard coded cyptographic key Critical 9.8
• CVE-2025-59345 Dragonfly did not enable authentication for some Manager’s endpoints High 7.7
• CVE-2025-59353 Manager generates mTLS certificates for arbitrary IP addresses High 7.7
• CVE-2025-59352 Dragonfly allows arbitrary file read and write on a peer machine Medium 6.9
• CVE-2025-59346 Dragonfly server-side request forgery vulnerability Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j8hf-cp34-g4j7, GO-2026-4356.