CVE-2026-49254
LowCVSS 2.9Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Dragonfly prior to 2.4.4 registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc() or RBAC(), while the handler returns models.Oauth records with client_secret exposed in JSON. When an administrator has configured a GitHub or Google OAuth provider, an unauthenticated network client can retrieve the provider's client secret, client identifier, and redirect URL.
Risk Assessment
Disclosure of client_secret can enable abuse of the configured identity-provider integration, subject to the provider's redirect URI restrictions, threatening the system's authentication security.
Recommendation
Upgrade Dragonfly to version 2.4.4 or later, which secures the OAuth GET handlers, and consider rotating any exposed client secrets.
Other vulnerabilities in Dragonfly
See all- CVE-2026-104192Critical
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account.
- CVE-2026-111279High
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.
- CVE-2026-54637Medium
In Dragonfly prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort values through RegisterPeerTask and ReportPeerResult. These values are copied into resource.Host, and Peer.DownloadTinyFile() builds an HTTP GET request without destination validation, allowing read SSRF against loopback, link-local, and private services. DownPort is restricted to 1024-65534, and up to 128 bytes of the response can be placed in Task.DirectPiece.
- CVE-2026-62357High
Dragonfly before version 1.40.0 has a vulnerability in CMS.INITBYDIM and CMS.INITBYPROW commands where an arithmetic overflow in buffer size calculation leads to undersized buffer allocation. This allows an unauthenticated remote client to corrupt or disclose adjacent heap memory and crash the server.
Original NVD description (English source)
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc() or RBAC(), while manager/handlers/oauth.go returns models.Oauth records and manager/models/oauth.go exposes Oauth.ClientSecret as client_secret in JSON. When an administrator has configured a GitHub or Google OAuth provider, an unauthenticated network client can reach GetOauth or GetOauths, load the stored models.Oauth record, and obtain the provider's client secret, client identifier, and redirect URL. The earlier GHSA-j8hf-cp34-g4j7 remediation protected the /jobs group only and did not protect these OAuth GET handlers. Disclosure of client_secret can enable abuse of the configured identity-provider integration, subject to the provider's redirect URI restrictions. This issue is fixed in 2.4.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS