Dragonflyoss vulnerabilities
We track 6 vulnerabilities in Dragonflyoss products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on January 22, 2026.
Latest Dragonflyoss vulnerabilities
- 9.8 Critical severity
dragonfly: Missing Authentication for Critical Functionality
Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This al
- 7.5 High severity
dragonfly: Improper Certificate Validation
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager’s
- 9.8 Critical severity
dragonfly: Improper Limitation of a Pathname to a Restricted Directory
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and HTTP APIs allow peers to send requests that force the recipient peer to create files in arbitrary file system locations, and to read arbitra
- 7.5 High severity
dragonfly: Use of Uninitialized Variable
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the processPieceFromSource method does not update the structure’s usedTraffic field, because an uninitialized variable n is used as a guard to the AddTraffic
- 9.1 Critical severity
dragonfly: Missing Authentication for Critical Functionality
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs and /preheats endpoints in Manager web UI are accessible without authentication. Any user with network access to the Manager can create, del
- 9.8 Critical severity
Dragonfly2: Use of Hard-coded Credentials
Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key"