Unauthenticated Access Flaw in Dragonfly File Distribution System
CVE-2026-24124

8.9HIGH

Key Information:

Vendor

Dragonflyoss

Status
Dragonfly
Vendor
CVE Published:
22 January 2026

What is CVE-2026-24124?

Dragonfly, an open-source P2P file distribution and image acceleration system, has a security flaw in its Job API endpoints (/api/v1/jobs) prior to version 2.4.1-rc.1. This issue arises from the absence of JWT authentication middleware and role-based access control (RBAC) checks, enabling unauthorized users to access, modify, and delete job entries when interfacing with the Manager API. It's crucial for users of versions 2.4.1-rc.0 and earlier to upgrade to the latest release to mitigate this security risk.

Affected Version(s)

dragonfly < 2.4.1-rc.1

References

https://github.com/dragonflyoss/dragonfly/security/adviso...
x_refsource_CONFIRM
https://github.com/dragonflyoss/dragonfly/commit/9fb9a2df...
x_refsource_MISC

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.