CVE-2025-59345

Description

Dragonfly doesn't have authentication enabled for some Manager’s endpoints in d7y.io/dragonfly

How to fix CVE-2025-59345

To remediate CVE-2025-59345, upgrade the affected package to a fixed version below.

• Go/d7y.io/dragonfly/v2—upgrade to 2.1.0 or later
• Go/d7y.io/dragonfly/v2—upgrade to 2.1.0 or later
• Go/github.com/dragonflyoss/dragonfly—upgrade to 2.1.0 or later
• —no fix listed

Is CVE-2025-59345 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

• from 0, < 2.1.0
• from 0, < 2.1.0
• from 0, < 2.1.0
• from 0

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-59345
• PATCHgithub.com/dragonflyoss/dragonfly
• WEBgithub.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
• WEBgithub.com/dragonflyoss/dragonfly/security/advisories/GHSA-89vc-vf32-ch59