CVE-2026-24124 is a critical missing authentication flaw (CVSS 9.8) in Dragonfly, the CNCF image and file distribution system. In versions up to 2.4.1-rc.0, the Manager's job API has no JWT or role checks, so anyone who can reach it can view, change or delete jobs. It is fixed in 2.4.1-rc.1 and 2.4.1.
What's affected
Dragonfly Manager, versions 2.4.1-rc.0 and below. The record says the fix is in 2.4.1-rc.1. The GitHub advisory lists v2.4.1 as the patched version, which is what most production setups should use. The affected component is the Manager REST API under /api/v1/jobs.
How to check if you're exposed
Check the Manager version in your Kubernetes manifests or Helm values, and in the running image:
kubectl get pods -A -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | grep -i dragonfly
Then check who can reach the Manager API port. Any user with network access to it is the attacker in this model, so a service exposed through an ingress, a load balancer or a flat internal network is a concern.
What to do now
- Upgrade Dragonfly to 2.4.1 or later.
- Limit access to the Manager API with network policies, so that only the components and operators that need it can connect.
- Do not publish the Manager through a public ingress without authentication in front.
- Review existing jobs for ones you did not create, and check for deleted or changed jobs.
- Consider what jobs do in your setup. In Dragonfly they relate to tasks such as preheating images, so unwanted jobs can consume resources.
Why it matters
The weakness is CWE-306, missing authentication for a critical function. The advisory explains the root cause in the router configuration. Other route groups use JWT and role based checks, while the job routes were left without them, with a code comment noting the work was still to do.
The advisory lists resource exhaustion, information disclosure and service disruption as the consequences. A to-do comment in a routing file is a typical way for such gaps to survive, which is why tests that check every route for authentication are worth having. The record does not list this CVE as known exploited.
Reading the severity score
The record gives a CVSS base score of 9.8, published 2026-01-22. In the vector, the attacker works over the network, needs no account, and the attack is low in complexity. User interaction is not needed. Impact on confidentiality is high, on integrity high and on availability high.
A base score describes the flaw in general, not your risk. Weigh it against how exposed your instance is and what it can reach. The Gold page for the CVE keeps the score, weakness and references together.
Hardening beyond the patch
Internal services drift toward open networks over time. Use Kubernetes network policies so that Dragonfly Manager accepts connections only from the components and operators that need it. Add authentication at the ingress if the API must be reachable, and write a test that requests every route without credentials and expects a rejection. That test would have caught a route group left without checks.
Find it across your own code
To see which of your packages are affected, the free in-browser dependency scan at gold.safeguard.sh/scan takes a manifest and lists known vulnerabilities. Reachability analysis then helps you judge whether your code calls the vulnerable path, so you can order the work.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do attackers need valid credentials?
No. The advisory says any unauthenticated user with access to the Manager API can reach the job endpoints.
Sources
Last reviewed: 19 October 2026.
