Dragonfly Manager Job API Allows Unauthenticated Access

Dragonfly allows arbitrary file read and write on a peer machine

Dragonfly did not enable authentication for some Manager’s endpoints

Manager generates mTLS certificates for arbitrary IP addresses

Dragonfly incorrectly handles a task structure’s usedTraffic field

Dragonfly Manager makes requests to external endpoints with disabled TLS authentication

Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

Dragonfly has weak integrity checks for downloaded files

Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error

Timing attacks against Proxy’s basic authentication are possible

Dragonfly server-side request forgery vulnerability

Dragonfly tiny file download uses hard coded HTTP protocol

Directories created via os.MkdirAll are not checked for permissions

Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth