CVE-2026-54637

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to v2.4.4-rc.2

Description The scheduler's v1 gRPC service is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF). A remote attacker can force the scheduler to make HTTP GET requests to arbitrary internal addresses, such as loopback (127.0.0.1), link-local (169.254.0.0/16), and RFC1918 ranges. This occurs because the DownloadTinyFile() function uses an HTTP client without address validation, taking the host and port directly from the attacker-controlled PeerHost.Ip and PeerHost.DownPort variables in the gRPC request body. The response from the internal service is stored in Task.DirectPiece and can be served to other peers, allowing for data exfiltration of up to 128 bytes per task. The issue is facilitated by the fact that the scheduler gRPC server uses insecure transport credentials by default and lacks an authentication interceptor.

Recommendations Update to a version where the DownloadTinyFile() function in scheduler/resource/standard/peer.go implements nethttp.NewSafeDialer().DialContext within the HTTP transport to reject non-global-unicast destinations. As a temporary mitigation, restrict network access to the scheduler's gRPC port to trusted sources only. Validate peerHost.Ip in the storeHost function to reject non-global-unicast addresses before they are stored.