Dragonfly, an open source peer‑to‑peer file distribution and image acceleration system, exposes its Manager Job API endpoints (/api/v1/jobs) without JWT authentication middleware or role‑based access controls in versions 2.4.1‑rc.0 and earlier. This CWE‑306 Missing Authentication weakness means any network user who can reach the Manager API can list, modify, or delete jobs. The missing authentication allows an attacker to read job metadata, potentially revealing sensitive information, to inject malicious jobs that may disrupt distribution processes, or to delete jobs, causing denial of service for legitimate users.

The vulnerability affects the Dragonfly project from the Linux Foundation, specifically versions 2.4.1‑rc.0 and all earlier releases. The issue is resolved in release 2.4.1‑rc.1. No other product variants or platforms are listed as impacted.

The CVSS score of 8.9 indicates a high‑severity flaw, and the EPSS score of less than 1% suggests the probability of exploitation is currently low. The vulnerability is not present in the CISA KEV catalog. Based on the description, the likely attack vector is a network user with access to the Manager API endpoint, which can be reached over HTTP/HTTPS. Because the API does not enforce authentication or RBAC, an unauthenticated attacker can directly invoke the endpoints and perform privileged operations on jobs.