CVE-2026-54637
Received Received - Intake

Dragonfly Scheduler Read SSRF via PeerHost.Ip

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort values through RegisterPeerTask and ReportPeerResult, storeHost copies those values into resource.Host, and handlePeerSuccess invokes Peer.DownloadTinyFile() for a TINY task. DownloadTinyFile() in scheduler/resource/standard/peer.go builds an HTTP GET request from the supplied address without destination validation, allowing a remote attacker to probe loopback, link-local, and private services and place up to TinyFileSize, 128 bytes, of a response in Task.DirectPiece for later retrieval. PeerHost.DownPort is restricted to ports 1024 through 65534, and the issue provides read SSRF rather than remote code execution. The remediation blocks loopback and link-local targets, while RFC1918 destinations remain reachable because IsGlobalUnicast accepts private ranges. This issue is fixed in 2.4.4-rc.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-54637
EUVD
EUVD-2026-78576

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dragonfly dragonfly to 2.4.4-rc.3 (exc)
dragonflyoss dragonfly to 2.4.4-rc.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54637 is a Server-Side Request Forgery (SSRF) vulnerability in the Dragonfly scheduler's v1 gRPC service. An unauthenticated remote attacker can manipulate PeerHost.Ip and PeerHost.DownPort fields in gRPC requests to force the scheduler to make HTTP requests to arbitrary internal addresses. The DownloadTinyFile function lacks address validation, allowing targeting of loopback, link-local, or private networks. The response is stored in Task.DirectPiece, enabling data exfiltration from internal services.

Detection Guidance

To detect this vulnerability, monitor network traffic for unexpected outbound connections from the Dragonfly scheduler to internal or restricted IP ranges. Check logs for HTTP requests to loopback (127.0.0.1), link-local (169.254.0.0/16), or RFC1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Use tools like tcpdump or Wireshark to capture traffic from the scheduler process.

Impact Analysis

An attacker could probe internal services like cloud metadata endpoints or private databases, potentially accessing sensitive data. They could exfiltrate up to 128 bytes of response data per request. While remote code execution isn't possible, unauthorized access to internal systems and data leakage are significant risks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Data exfiltration risks may result in non-compliance with data protection principles, potentially triggering regulatory penalties or breach notifications.

Mitigation Strategies

Upgrade Dragonfly to version 2.4.4-rc.3 or later to apply the patch. If upgrading is not immediately possible, restrict network access to the scheduler's gRPC service to trusted sources only. Disable unauthenticated v1 gRPC flows if not required. Monitor for unusual outbound connections and block internal address ranges at the firewall level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54637. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart