Listen to this Post
The vulnerability exists in the Dragonfly Manager’s routing configuration. In the source code file manager/router/router.go, the route group for `/api/v1/jobs` (lines 204-211) is defined without the mandatory JWT authentication middleware (jwt.MiddlewareFunc()) and Role-Based Access Control (RBAC) wrapper that protect other endpoints like /clusters. This omission allows any HTTP request reaching these job endpoints to bypass authentication entirely. An unauthenticated attacker can send GET, POST, PATCH, and DELETE requests to perform full CRUD operations on job resources. This can lead to information disclosure of all jobs, creation of malicious jobs to exhaust system resources (Denial-of-Service), arbitrary modification of job parameters, and deletion of critical jobs disrupting the file distribution service.
Platform: Dragonfly Manager
Version: v2.x (v2.4.0)
Vulnerability : Missing Authentication Middleware
Severity: Critical
date: 2026-01-17
Prediction: 2026-02-28
What Undercode Say:
Vulnerable code in manager/router/router.go
job := apiv1.Group("/jobs")
job.POST("", middlewares.CreateJobRateLimiter(limiter), h.CreateJob)
job.DELETE(":id", h.DestroyJob)
job.PATCH(":id", h.UpdateJob)
job.GET(":id", h.GetJob)
job.GET("", h.GetJobs)
Fixed code should be:
job := apiv1.Group("/jobs", jwt.MiddlewareFunc(), rbac)
Bash command to test vulnerability
curl -s -X GET http://localhost:8080/api/v1/jobs
Bash command to create job
curl -s -X POST http://localhost:8080/api/v1/jobs -H "Content-Type: application/json" -d '{"type":"preheat","args":{"type":"file","url":"http://example.com/test.txt"},"scheduler_cluster_ids":[bash]}'
How Exploit:
- Attacker identifies exposed Dragonfly Manager API (port 8080).
- Attacker sends unauthenticated HTTP requests to `/api/v1/jobs` endpoints.
- Attacker performs CRUD operations: lists jobs via GET, creates resource-exhaustion jobs via POST, modifies/deletes existing jobs via PATCH/DELETE.
Protection from this CVE
Apply the code fix to add `jwt.MiddlewareFunc(), rbac` to the `/jobs` route group. Implement network-level controls: restrict API access with firewalls or Kubernetes NetworkPolicy. Deploy an API gateway with authentication in front of the Manager.
Impact:
Unauthorized Job Control, Information Disclosure, Resource Exhaustion Denial-of-Service, Service Disruption
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
