anonhaven
Ad

CVE-2026-31882

HIGH CVSS 3.1: 7.5 EPSS 0.19%
Updated Mar 16, 2026
Dagu
Parameter Value
CVSS 7.5 (HIGH)
Fixed In 2.2.4
Type CWE-306 (Missing Authentication for Critical Function)
Vendor Dagu
Public PoC No

Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication (DAGU_AUTH_MODE=basic), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG execution data, workflow configurations, execution logs, and queue status — bypassing the authentication that protects the REST API.

The buildStreamAuthOptions() function builds authentication options for SSE/streaming endpoints. When the auth mode is basic, it returns an auth.Options struct with BasicAuthEnabled: true but AuthRequired defaults to false (Go zero value). The authentication middleware at internal/service/frontend/auth/middleware.go allows unauthenticated requests when AuthRequired is false.

This vulnerability is fixed in 2.2.4.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-306 Missing Authentication for Critical Function

References 4

https://github.com/dagu-org/dagu/commit/064616c9b80c04824c1c7c357308f77f3f24d775
security-advisories@github.com
https://github.com/dagu-org/dagu/pull/1752
security-advisories@github.com
https://github.com/dagu-org/dagu/releases/tag/v2.2.4
security-advisories@github.com
https://github.com/dagu-org/dagu/security/advisories/GHSA-9wmw-9wph-2vwp
security-advisories@github.com
Share Post Share Share Share