Linuxfoundation Dragonfly vulnerabilities

• dragonflyoss dragonfly Dragonfly Manager Job API Allows Unauthenticated Access CVE-2026-24124 Fix available 8.9 HighJanuary 22, 2026
• dragonflyoss dragonfly Dragonfly tiny file download uses hard coded HTTP protocol CVE-2025-59410 Fix available 5.5 MediumSeptember 17, 2025
• dragonflyoss dragonfly Dragonfly has weak integrity checks for downloaded files CVE-2025-59354 Fix available 5.5 MediumSeptember 17, 2025
• dragonflyoss dragonfly Manager generates mTLS certificates for arbitrary IP addresses CVE-2025-59353 Fix available 7.7 HighSeptember 17, 2025
• dragonflyoss dragonfly Dragonfly allows arbitrary file read and write on a peer machine CVE-2025-59352 Fix available 6.9 MediumSeptember 17, 2025
• dragonflyoss dragonfly Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error CVE-2025-59351 Fix available 2.7 LowSeptember 17, 2025
• dragonflyoss dragonfly Timing attacks against Proxy’s basic authentication are possible CVE-2025-59350 Fix available 2.7 LowSeptember 17, 2025
• dragonflyoss dragonfly Directories created via os.MkdirAll are not checked for permissions CVE-2025-59349 Fix available 2.0 LowSeptember 17, 2025
• dragonflyoss dragonfly Dragonfly incorrectly handles a task structure’s usedTraffic field CVE-2025-59348 Fix available 5.5 MediumSeptember 17, 2025
• dragonflyoss dragonfly Dragonfly Manager makes requests to external endpoints with disabled TLS authentication CVE-2025-59347 Fix available 2.7 LowSeptember 17, 2025
• dragonflyoss dragonfly Dragonfly server-side request forgery vulnerability CVE-2025-59346 Fix available 5.5 MediumSeptember 17, 2025
• dragonflyoss dragonfly Dragonfly did not enable authentication for some Manager’s endpoints CVE-2025-59345 Fix available 7.7 HighSeptember 17, 2025
• dragonflyoss dragonfly2, linuxfoundation dragonfly +1 more Dragonfly2 vulnerable to hard coded cyptographic key CVE-2023-27584 Fix available EPSS 33.9% 9.8 CriticalSeptember 19, 2024