GHSA-4q9j-6299-gxmr Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth

• Go d7y.io/dragonfly/v2: < 2.4.4 → fixed in 2.4.4

Summary The Dragonfly Manager exposes `GET /api/v1/oauth` and `GET /api/v1/oauth/:id` to unauthenticated clients. The response body deserializes the entire `manager/models.Oauth` struct, which includes the `client_secret` field. Any network-reachable attacker can read the OAuth client secrets configured for `github` or `google` providers, defeating the confidentiality guarantee of those secrets and enabling subsequent abuse against the connected identity providers. Affected versions `github.com/dragonflyoss/dragonfly` ` /Users/rick/df2-poc/docker-compose.yaml <<'YAML' services: redis: image: redis:6-alpine container_name: dragonfly-redis command: --requirepass dragonfly mysql: image: mariadb:10.6 container_name: dragonfly-mysql environment: • MARIADB_USER=dragonfly • MARIADB_PASSWORD=dragonfly • MARIADB_DATABASE=manager • MARIADB_ALLOW_EMPTY_ROOT_PASSWORD=yes manager: image: dragonflyoss/manager:v2.4.3 container_name: dragonfly-manager depends_on: [redis, mysql] restart: on-failure volumes: • ./config/manager.yaml:/etc/dragonfly/manager.yaml:ro ports: • "18080:8080" YAML docker compose -f /Users/rick/df2-poc/docker-compose.yaml up -d until curl -fsS -o /dev/null http://localhost:18080/healthy; do sleep 2; done ``` Bootstrap one administrator and register an OAuth provider whose secret we plant as a sentinel: ```bash Sign up + promote to root…