Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth (CVE-2026-49254) | HOL Guard CVE

Low severityCVE-2026-49254GHSA-4Q9J-6299-GXMR

Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth

Answer in brief

CVE-2026-49254 records a Low severity vulnerability in Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth. The current sources do not mark it as known exploited. The current feed maps dragonflyoss/dragonfly (generic), d7y.io/dragonfly/v2 (go). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 15, 2026Updated Sep 15, 2026Source checked Sep 17, 2026First seen by HOL Jul 2, 2026Material review Sep 15, 2026

Upstream Advisory

Key facts

Risk: Low
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps dragonflyoss/dragonfly (generic), d7y.io/dragonfly/v2 (go). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
dragonflyoss/dragonflygeneric	< 2.4.4	Not reported
d7y.io/dragonfly/v2go	<=2.4.3	2.4.4

Recommended response

Check inventory. Check lockfiles and deployed manifests for dragonflyoss/dragonfly, d7y.io/dragonfly/v2.
Review the reported fix. Update d7y.io/dragonfly/v2 to 2.4.4 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Jul 2, 2026

Sources and claim methodology

Upstream source description

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc() or RBAC(), while manager/handlers/oauth.go returns models.Oauth records and manager/models/oauth.go exposes Oauth.ClientSecret as client_secret in JSON. When an administrator has configured a GitHub or Google OAuth provider, an unauthenticated network client can reach GetOauth or GetOauths, load the stored models.Oauth record, and obtain the provider's client secret, client identifier, and redirect URL. The earlier GHSA-j8hf-cp34-g4j7 remediation protected the /jobs group only and did not protect these OAuth GET handlers. Disclosure of client_secret can enable abuse of the configured identity-provider integration, subject to the provider's redirect URI restrictions. This issue is fixed in 2.4.4.

Quoted source text, attributed separately from HOL analysis.