Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile (CVE-2026-54637)

Dragonfly is an open source P2P file distribution system. In versions before 2.4.4-rc.3, the scheduler's unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort parameters via RegisterPeerTask and ReportPeerResult. These values are copied into resource.Host and used by DownloadTinyFile() to build an HTTP GET request without validating the destination address. This allows an attacker to perform SSRF attacks by probing loopback, link-local, and private network services and retrieving up to 128 bytes of response data. The vulnerability restricts ports to 1024-65534 and does not allow remote code execution. The fix in 2.4.4-rc.3 blocks loopback and link-local targets but still allows RFC1918 private ranges.

An unauthenticated remote attacker can exploit this SSRF vulnerability to probe internal network services accessible from the Dragonfly scheduler host. The attacker can retrieve small amounts of data (up to 128 bytes) from these services, potentially disclosing sensitive information. The vulnerability does not allow remote code execution or privilege escalation. The risk is limited to information disclosure via SSRF.

A fix is available in Dragonfly version 2.4.4-rc.3 that blocks SSRF requests to loopback and link-local addresses. Users should upgrade to this version or later to remediate the vulnerability. Since the vulnerability is unauthenticated, upgrading is strongly recommended. No additional mitigations are specified by the vendor advisory.