CVE-2026-24124: Dragonfly Auth Bypass Vulnerability

CVE-2026-24124 Overview

CVE-2026-24124 is a critical authentication bypass vulnerability in Dragonfly, an open source P2P-based file distribution and image acceleration system. The vulnerability exists in the Job API endpoints (/api/v1/jobs) which lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with network access to the Manager API to view, update, and delete jobs without proper authorization.

Critical Impact

Unauthenticated attackers can access, modify, and delete job configurations in Dragonfly deployments, potentially disrupting file distribution operations and compromising system integrity.

Affected Products

• Dragonfly version 2.4.1-rc.0 and below
• Dragonfly Manager API component
• Systems with exposed /api/v1/jobs endpoints

Discovery Timeline

• January 22, 2026 - CVE-2026-24124 published to NVD
• January 22, 2026 - Last updated in NVD database

Technical Details for CVE-2026-24124

Vulnerability Analysis

This vulnerability represents a missing authentication for critical function (CWE-306) in Dragonfly's Manager API component. The Job API endpoints are exposed without the proper security middleware that protects other API routes. While other endpoints in the Manager API require JWT token validation and role-based access control (RBAC) verification, the job management endpoints were inadvertently configured without these protections in the routing layer.

The flaw allows unauthenticated network users to perform full CRUD (Create, Read, Update, Delete) operations on job resources. In containerized environments where Dragonfly is commonly deployed for image acceleration, this could allow attackers to manipulate job scheduling, access sensitive job metadata, or cause denial of service by deleting critical jobs.

Root Cause

The root cause lies in the routing configuration where the /api/v1/jobs endpoints were not wrapped with the JWT authentication middleware and RBAC authorization checks that are applied to other protected API routes. This configuration oversight resulted in the job management functionality being publicly accessible to any user with network connectivity to the Manager API.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with network access to the Dragonfly Manager API can directly send HTTP requests to the vulnerable job endpoints. The attack complexity is low since the endpoints accept standard REST API calls without any authentication headers.

Exploitation involves sending unauthenticated HTTP requests to the /api/v1/jobs endpoint to enumerate, modify, or delete job configurations. The attacker could list all configured jobs to gather information about the deployment, modify job parameters to introduce malicious configurations, or delete jobs to disrupt file distribution operations. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-24124

Indicators of Compromise

• Unexpected HTTP requests to /api/v1/jobs endpoints without valid JWT tokens in the Authorization header
• Anomalous job creation, modification, or deletion activity in Manager API logs
• Unauthenticated requests from external or unknown IP addresses targeting job management endpoints

Detection Strategies

• Monitor Manager API access logs for requests to /api/v1/jobs that lack JWT authentication headers
• Implement network intrusion detection rules to flag unauthenticated API calls to job endpoints
• Configure alerting for job modifications that don't correlate with authorized administrative actions
• Review audit logs for bulk job deletions or unusual job parameter changes

Monitoring Recommendations

• Enable verbose logging on the Dragonfly Manager API to capture all requests to job endpoints
• Deploy web application firewall (WAF) rules to detect and block unauthenticated API access attempts
• Implement anomaly detection for API request patterns targeting the vulnerable endpoints
• Monitor for unexpected changes to job configurations through periodic integrity checks

How to Mitigate CVE-2026-24124

Immediate Actions Required

• Upgrade Dragonfly to version 2.4.1-rc.1 or later which includes the security fix
• Restrict network access to the Manager API to trusted hosts only using firewall rules
• Implement network segmentation to limit exposure of the Manager API to internal networks
• Review audit logs for any suspicious activity targeting the job endpoints prior to patching

Patch Information

The vulnerability is fixed in Dragonfly version 2.4.1-rc.1. The fix adds proper JWT authentication middleware and RBAC authorization checks to the Job API routes. The patch can be reviewed in the GitHub commit. Organizations should update to the patched version as soon as possible.

Workarounds

• Deploy a reverse proxy or API gateway in front of the Manager API to enforce authentication on all endpoints
• Use network-level access controls to restrict Manager API access to authorized administrator IP addresses only
• Implement firewall rules to block external access to the /api/v1/jobs endpoint until patching is complete
• Consider temporarily disabling the Job API if it is not critical for operations until the upgrade can be performed

# Example: Restrict Manager API access using iptables
# Allow only trusted admin network to access Manager API port
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP