CVE-2025-59345 is a critical (CVSS 9.1) missing authentication flaw in the Dragonfly Manager web UI before version 2.1.0. The jobs and preheat endpoints need no login. The advisory says there is no workaround beyond upgrading to 2.1.0. The sections below cover who is affected, how to check, and what to do now.
What's affected
Per GitHub advisory GHSA-89vc-vf32-ch59, Dragonfly versions before 2.1.0 are affected, for both the github.com/dragonflyoss/dragonfly and d7y.io/dragonfly/v2 Go modules. The fix is in 2.1.0.
The affected endpoints are /api/v1/jobs and /preheats in the Manager web UI.
How to check if you're exposed
Find your Dragonfly components and their versions. The advisory says everything before 2.1.0 is affected.
kubectl get pods -A -o jsonpath='{..image}' | tr ' ' '\n' | grep -i dragonfly | sort -u
For Go builds that import the module, check the module version:
go list -m all | grep -i dragonfly
The advisory lists both github.com/dragonflyoss/dragonfly and d7y.io/dragonfly/v2 as affected module paths.
What to do now
- Upgrade Dragonfly to 2.1.0 or later, Manager first.
- Until then, restrict network access to the Manager so only administrators and peers that need it can reach it. The advisory says nothing else works as a fix, but reducing reachability reduces exposure.
- Review the Manager job list for jobs you did not create.
- Check that the Manager is not exposed beyond your cluster network.
- Add the Manager to your inventory so version drift is visible.
Why it matters
The record maps this to CWE-306, missing authentication for a critical function. Anyone with network access to the Manager can create, delete and modify jobs and create preheat jobs. The advisory's own example is flooding the Manager with useless jobs until it stops answering real administrators, a denial of service.
The vector shows integrity and availability impact high and no confidentiality impact. The advisory points to a third party security audit by Trail of Bits as the origin of the finding. This CVE is not on the CISA KEV list.
Missing authentication is the simplest class of access flaw to describe and one of the easiest to prevent. A function that changes data or reveals data must check who is asking, every time, on the server. Hiding the URL, or relying on the front end to show a login screen first, does not count as a check.
A useful habit is to list every route, endpoint and file an application exposes and mark which ones enforce a login. Anything unmarked is a finding until proven otherwise. Network controls such as an allow list or a VPN reduce who can reach the service, but they are a layer on top of authentication, not a substitute for it.
Safeguard can help you find this one in your own software. The free in-browser dependency scan at gold.safeguard.sh/scan reads your manifest or lockfile and shows which known vulnerabilities your declared dependencies carry, including transitive ones. Reachability analysis then helps you separate the places where your code actually calls the affected component from the places where it only sits in the tree, which makes it easier to decide what to patch first.
Quick check
Is there a workaround for CVE-2025-59345?
The advisory says there are no effective workarounds beyond upgrading to 2.1.0.
What can an unauthenticated user do?
Create, delete and modify jobs and create preheat jobs on the Manager, which can leave it unable to serve administrators.
Sources
- GitHub advisory GHSA-89vc-vf32-ch59
- NVD record data
Last reviewed: 18 October 2026.
