{"items":[{"id":"NVI-00017510","kind":"vulnerability","title":"Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-4q9j-6299-gxmr","CVE-2026-49254"],"plain_summary":"GitHub lists this reviewed advisory for d7y.io/dragonfly/v2. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0f2a10b9064926ac43c7914d83aba71b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0f2a10b9064926ac43c7914d83aba71b","url":"https://github.com/advisories/GHSA-4q9j-6299-gxmr","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-4q9j-6299-gxmr","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T03:47:42.887Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0f2a10b9064926ac43c7914d83aba71b"],"technology":"d7y.io/dragonfly/v2","known_exclusions":[],"conditions_summary":"### Summary\n\nThe Dragonfly Manager exposes `GET /api/v1/oauth` and `GET /api/v1/oauth/:id` to unauthenticated clients. The response body deserializes the entire `manager/models.Oauth` struct, which includes the `client_secret` field. Any network-reachable attacker can read the OAuth client secrets configured for `github` or `google` providers, defeating the confidentiality guarantee of those secrets and enabling subsequent abuse against the connected identity providers.\n\n### Affected versions\n\n`github.com/dragonflyoss/dragonfly` `<= v2.4.3` (and current `main` at commit `46a8f1e`). The vulnerable wiring is present back to the introduction of OAuth GET handlers and was not addressed by GHSA-j8hf-cp34-g4j7 / CVE-2026-24124, whose remediation only added `jwt + rbac` middleware to the `/jobs` group.\n\n### Privilege required\n\nUnauthenticated. The only precondition is that an administrator has registered at least one OAuth provider via `POST /api/v1/oauth` (a one-time setup for tenants that enable GitHub / Google sign-in).\n\n### Vulnerable code\n\n[`manager/router/router.go:134-140`](https://github.com/dragonflyoss/dragonfly/blob/e1491bf6134fe307b09e82e11fa94b0587dcd323/manager/router/router","public_affected_ranges":["<= 2.4.3"]}],"null_published_at":"2026-11-05T19:10:21.401Z","source_updated_at":"2026-07-02T19:21:31.000Z","source_disclosed_at":"2026-07-02T19:21:30.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T03:47:42.887Z"}],"next_cursor":null,"snapshot_revision":"42594"}