{"action":"Upgrade d7y.io/dragonfly/v2 to 2.4.4-rc.3 or later.","affected":[{"fixed":"2.4.4-rc.3","introduced":"0"}],"component":"d7y.io/dragonfly/v2","cve_ids":["CVE-2026-54637"],"ecosystem":"Go","epss":0.008,"exploited":false,"fixed_versions":["2.4.4-rc.3"],"ghsa_id":"GHSA-chwm-m7g7-685g","id":"tcs_01M5KF7CQPB0WM3YPBJCQVCRAM","modified_at":"2026-07-07T16:11:28.692686462Z","published_at":"2026-07-06T20:32:33Z","references":["https://osv.dev/vulnerability/GHSA-chwm-m7g7-685g","https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-chwm-m7g7-685g","https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-fhf9-m53m-863g","https://github.com/dragonflyoss/Dragonfly2/blob/main/scheduler/resource/standard/peer.go#L457-L459","https://github.com/dragonflyoss/dragonfly","https://github.com/dragonflyoss/dragonfly/blob/0822e3aecc3369017d6b25c9441ff6f318129b31/internal/job/image.go#L211","https://github.com/dragonflyoss/dragonfly/blob/0822e3aecc3369017d6b25c9441ff6f318129b31/pkg/net/http/http.go#L50-L80","https://github.com/dragonflyoss/dragonfly/blob/0822e3aecc3369017d6b25c9441ff6f318129b31/pkg/rpc/scheduler/server/server.go#L71-L90","https://github.com/dragonflyoss/dragonfly/blob/0822e3aecc3369017d6b25c9441ff6f318129b31/scheduler/resource/standard/peer.go#L435-L478","https://github.com/dragonflyoss/dragonfly/blob/0822e3aecc3369017d6b25c9441ff6f318129b31/scheduler/scheduler.go#L235-L246","https://github.com/dragonflyoss/dragonfly/blob/0822e3aecc3369017d6b25c9441ff6f318129b31/scheduler/service/service_v1.go#L1176-L1202","https://github.com/dragonflyoss/dragonfly/blob/0822e3aecc3369017d6b25c9441ff6f318129b31/scheduler/service/service_v1.go#L816-L845"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-chwm-m7g7-685g","url":"https://osv.dev/vulnerability/GHSA-chwm-m7g7-685g"}],"summary":"Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile"}