CVE-2025-59353: Manager generates mTLS certificates for arbitrary IP addresses
Impact A peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager’s Certificate gRPC service does not validate if the requested IP addresses “belong to” the peer requesting the certificate—that is, if the peer connects from the same IP address as the one provided in the certificate request.
golang if addr, ok := p.Addr.(net.TCPAddr); ok { ip = addr.IP.String() } else { ip, , err = net.SplitHostPort(p.Addr.String()) if err != nil { return nil, err } } // Parse csr. [skipped] // Check csr signature. // TODO check csr common name and so on. if err = csr.CheckSignature(); err != nil { return nil, err } [skipped] // TODO only valid for peer ip // BTW we need support both of ipv4 and ipv6. ips := csr.IPAddresses if len(ips) == 0 { // Add default connected ip. ips = []net.IP{net.ParseIP(ip)} } Patches
- Dragonfy v2.1.0 and above.
Workarounds
There are no effective workarounds, beyond upgrading.
References
A third party security audit was performed by Trail of Bits, you can see the full report.
If you have any questions or comments about this advisory, please email us at dragonfly-maintainers@googlegroups.com.
Other sources
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager’s Certificate gRPC service does not validate if the requested IP addresses “belong to” the peer requesting the certificate—that is, if the peer connects from the same IP address as the one provided in the certificate request. This vulnerability is fixed in 2.1.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59353?
CVE-2025-59353 has a high severity as it allows peers to obtain valid TLS certificates for arbitrary IP addresses, compromising mTLS authentication.
How do I fix CVE-2025-59353?
To fix CVE-2025-59353, update Dragonfly to version 2.1.0 or later.
What software is affected by CVE-2025-59353?
CVE-2025-59353 affects Dragonfly versions up to 2.1.0.
What type of vulnerability is CVE-2025-59353?
CVE-2025-59353 is a certificate validation vulnerability that impacts mTLS authentication.
Can CVE-2025-59353 lead to unauthorized access?
Yes, CVE-2025-59353 can lead to unauthorized access as it undermines the security of mTLS by allowing any peer to obtain valid TLS certificates.