CVE-2026-54637— Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile
Quick assessment
Affected
dragonflyoss dragonfly
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Dragonfly 是一个基于 P2P（对等网络）的文件分发和镜像加速开源系统。在版本 2.4.4-rc.3 之前，其调度器默认的未认证 v1 gRPC 流程允许攻击者通过 和 接口提供由攻击者控制的 和 值。随后， 函数会将这些值复制到 中，而 函数在处理 TINY 类型任务时，会调用 。 文件中的 函数使用提供的地址构建 HTTP GET 请求，且未对目标地址进行任何验证，这使得远程攻击者能够探测回环地址（loopback）、链路本地地址（link-local）以及私有网络中的服务，并将响应内容的前 128 字
Possible ATT&CK Techniques 1 AI
T1090 · Proxy
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54637
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile
Source: CVE Program / CVE List V5
Vulnerability Description
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort values through RegisterPeerTask and ReportPeerResult, storeHost copies those values into resource.Host, and handlePeerSuccess invokes Peer.DownloadTinyFile() for a TINY task. DownloadTinyFile() in scheduler/resource/standard/peer.go builds an HTTP GET request from the supplied address without destination validation, allowing a remote attacker to probe loopback, link-local, and private services and place up to TinyFileSize, 128 bytes, of a response in Task.DirectPiece for later retrieval. PeerHost.DownPort is restricted to ports 1024 through 65534, and the issue provides read SSRF rather than remote code execution. The remediation blocks loopback and link-local targets, while RFC1918 destinations remain reachable because IsGlobalUnicast accepts private ranges. This issue is fixed in 2.4.4-rc.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| dragonflyoss | dragonfly | < 2.4.4-rc.3 | - |
|
II. Public POCs for CVE-2026-54637
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54637
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-54637 (1)
Vendor Advisories for CVE-2026-54637 (1)
Vendor Pages for CVE-2026-54637 (1)
-
🔗 Release v2.4.4-rc.3 · dragonflyoss/dragonfly · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: dragonfly
-
CVE-2026-49254
Dragonfly Manager OAuth provider client_secret disclosure vi -
CVE-2026-62357
DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remo -
CVE-2026-54341
Dragonfly: RESTORE operations may crash the server -
CVE-2026-47206
Dragonfly: RESP Protocol Injection via Lua redis.error_reply -
CVE-2026-24124
Dragonfly Manager Job API Allows Unauthenticated Access
Same vendor: dragonflyoss
-
CVE-2026-49254
Dragonfly Manager OAuth provider client_secret disclosure vi -
CVE-2026-24124
Dragonfly Manager Job API Allows Unauthenticated Access -
CVE-2025-59410
Dragonfly tiny file download uses hard coded HTTP protocol -
CVE-2025-59354
Dragonfly has weak integrity checks for downloaded files -
CVE-2025-59353
Manager generates mTLS certificates for arbitrary IP address
Same weakness: CWE-918
-
CVE-2026-58201
Lokka: Azure Resource Manager URL path validation issue -
CVE-2026-58196
ToolHive: SSRF in remote MCP server authentication discovery -
CVE-2026-54450
ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, -
CVE-2026-77866
SSRF protection bypass in safeurl via IPv6 addresses and unr -
CVE-2026-55591
Signal K Server: Server-Side Request Forgery via Remote Conn
V. Comments for CVE-2026-54637
No comments yet