Ghostwire

CVE-2026-54637: Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

MEDIUM CVSS 0.0 Exploit Available

Published: July 6, 2026 | Last Modified: July 6, 2026

Description

Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

Ghostwire Analysis — What This Means Practically

Exploit code is reported to be available, increasing the likelihood of active exploitation.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

Security Coverage (2 articles)

References

github.com/dragonflyoss/dragonfly/security/advisories/GHSA-chwm-m7g7-685g
github.com/dragonflyoss/dragonfly/blob/0822e3aecc3369017d6b25c9441ff6f318129b31/
github.com/dragonflyoss/dragonfly/blob/0822e3aecc3369017d6b25c9441ff6f318129b31/
github.com/dragonflyoss/dragonfly/blob/0822e3aecc3369017d6b25c9441ff6f318129b31/
github.com/dragonflyoss/dragonfly/blob/0822e3aecc3369017d6b25c9441ff6f318129b31/
github.com/dragonflyoss/dragonfly/blob/0822e3aecc3369017d6b25c9441ff6f318129b31/
github.com/dragonflyoss/dragonfly/blob/0822e3aecc3369017d6b25c9441ff6f318129b31/
github.com/dragonflyoss/dragonfly/blob/0822e3aecc3369017d6b25c9441ff6f318129b31/
github.com/dragonflyoss/dragonfly/security/advisories/GHSA-fhf9-m53m-863g
github.com/dragonflyoss/Dragonfly2/blob/main/scheduler/resource/standard/peer.go
github.com/advisories/GHSA-chwm-m7g7-685g
www.tenable.com/cve/CVE-2026-54637
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-54637