What is the CVSS score of CVE-2026-24124?

CVE-2026-24124 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Dragonfly are affected by CVE-2026-24124?

Dragonfly versions 2.4.1-rc.0 and below contain a critical authentication bypass vulnerability in the Job API that allows unauthenticated users to access and manipulate job operations.. A patch is available.

Is there a public PoC exploit available for CVE-2026-24124?

Yes, a public proof-of-concept exploit is available for CVE-2026-24124. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-24124?

Within 24 hours: Identify all systems running Dragonfly 2.4.1-rc.0 or below and assess their network exposure. Within 7 days: Apply the available vendor patch to all affected instances or implement network-level access controls restricting Job API endpoints. Within 30 days: Conduct security audit of Job API access logs to identify any unauthorized access attempts and verify patch deployment across the entire infrastructure.

Dragonfly CVE-2026-24124

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-01-22 security-advisories@github.com

GHSA-j8hf-cp34-g4j7

Authentication Bypass Dragonfly Suse Linuxfoundation

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

8.9 HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 26, 2026 - 21:42 vuln.today

Public exploit code

Patch released

Feb 26, 2026 - 21:42 nvd

Patch available

CVE Published

Jan 22, 2026 - 23:15 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with access to the Manager API to view, update and delete jobs. The issue is fixed in version 2.4.1-rc.1.

AnalysisAI

Dragonfly P2P file distribution system versions 2.4.1-rc.0 and below have a missing authentication vulnerability allowing unauthenticated access to the management API.

Technical ContextAI

Dragonfly <= 2.4.1-rc.0 exposes management API endpoints without authentication (CWE-306), allowing unauthenticated users to control the P2P file distribution and container image acceleration infrastructure.