Auth bypass in Dragonflyoss Dragonfly
CVE-2025-59345
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs and /preheats endpoints in Manager web UI are accessible without authentication. Any user with network access to the Manager can create, delete, and modify jobs, and create preheat jobs. An unauthenticated adversary with network access to a Manager web UI uses /api/v1/jobs endpoint to create hundreds of useless jobs. The Manager is in a denial-of-service state, and stops accepting requests from valid administrators. This vulnerability is fixed in 2.1.0.
Vulnerability class: Broken Authentication
EPSS: 0.004 (31.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
Affected products
- Dragonflyoss Dragonfly — versions < 2.1.0
- Linuxfoundation Dragonfly
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-59345?
- CVE-2025-59345 is a critical-severity vulnerability in Dragonflyoss Dragonfly, classified under Missing Authentication for Critical Function. CVSS score: 9.1/10. Published 2025-09-17.
- How severe is CVE-2025-59345?
- Critical severity. CVSS v3 base score is 9.1 out of 10.
- Is CVE-2025-59345 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.