Dragonfly did not enable authentication for some Manager’s endpoints

Vulnerability

Overview

CVE-2025-59345 is an authentication bypass vulnerability in the Dragonfly Manager component, affecting versions prior to 2.1.0. The /api/v1/jobs and /preheats endpoints are accessible without any authentication, allowing any user with network access to the Manager web UI to interact with job management functions [1][4].

Exploitation

An unauthenticated attacker with network access to the Manager web UI can exploit this by sending requests to the /api/v1/jobs endpoint to create a large number of useless jobs. No authentication or prior access is required, making the attack surface broad for any exposed Manager instance [1].

Impact

By creating hundreds of jobs, the attacker can overwhelm the Manager, causing it to enter a denial-of-service (DoS) state. In this state, the Manager stops accepting legitimate requests from valid administrators, effectively disrupting normal operations and preventing administrative management of the Dragonfly system [1].

Mitigation

The vulnerability is fixed in Dragonfly version 2.1.0. Users should upgrade to this version or later to remediate the issue. No workarounds are mentioned in the available references [1][3].