CVE-2026-49254
2 advisories.
Go/d7y.io/dragonfly/v2 CVE-2026-49254: low, EPSS 0.48%
Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth
Action: Upgrade d7y.io/dragonfly/v2 to 2.4.4 or later.
go get d7y.io/dragonfly/v2@v2.4.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.4.4 | - |
Fixed versions
| 2.4.4 |
Sources
- osv: GHSA-4q9j-6299-gxmr
- https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-4q9j-6299-gxmr
- https://github.com/dragonflyoss/dragonfly
CVE-2026-49254 · published · modified · JSON
Go/d7y.io/dragonfly/v2 CVE-2026-49254: unknown, EPSS 0.48%
Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth in d7y.io/dragonfly
Action: Upgrade d7y.io/dragonfly/v2 to 2.4.4 or later.
go get d7y.io/dragonfly/v2@v2.4.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.4.4 | - |
Fixed versions
| 2.4.4 |
Sources
CVE-2026-49254 · published · modified · JSON