CVE-2023-27584

Dragonfly2, the CNCF-incubating peer-to-peer file distribution and image acceleration system hosted by the Linux Foundation, signs and verifies its JWT authentication tokens with a hard-coded secret ('Secret Key'), enabling an authentication bypass tracked as CVE-2023-27584 (CVSS 9.8, CWE-321/CWE-798). Because the same secret is embedded in the code across deployments, an attacker with network access to the API can forge a valid, signed JWT for any user without knowing any credentials. With such a forged token, the attacker can perform any action with full administrator privileges on the Dragonfly deployment. All users running versions prior to the 2.0.9 release are affected; the issue was fixed in 2.0.9, and the GitHub advisory (GHSA-hpc8-7wpm-889w) advises all users to upgrade, with no known workarounds. The flaw is not in the CISA KEV catalog and there are no confirmed in-the-wild exploitation reports, but a public advisory with PoC reference exists and EPSS assigns a 33.6% probability of exploitation within 30 days (98th percentile), making prompt patching advisable.

What to do: Upgrade to Dragonfly 2.0.9 or later immediately, as there are no workarounds for the hard-coded JWT secret. Until patched, restrict network access to the Dragonfly API from untrusted networks and review logs for unexpected administrative actions, since any deployment reachable by an attacker can be compromised with a forged admin token.