Read the docs
TI-2026-24434 Aliases CVE-2026-31882GHSA-9wmw-9wph-2vwp

Dagu SSE Authentication Bypass in Basic Auth Mode

Priority HIGH 66CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.

Summary

Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication (DAGU_AUTH_MODE=basic), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG execution data, workflow configurations, execution logs, and queue status — bypassing the authentication that protects the REST API. The buildStreamAuthOptions() function builds authentication options for SSE/streaming endpoints. When the auth mode is basic, it returns an auth.Options struct with BasicAuthEnabled: true but AuthRequired defaults to false (Go zero value). The authentication middleware at internal/service/frontend/auth/middleware.go allows unauthenticated requests when AuthRequired is false. This vulnerability is fixed in 2.2.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00827 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed dagu (dagu-org): 2.2.4dagu (npm): 2.2.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dagu-orgdagubefore 2.2.42.2.4Patch availableCNA
—dagu (npm)before 2.2.42.2.4Patch availableGHSA-9wmw-9wph-2vwp
  • dagu Vendordagu-org Affected before 2.2.4 Fixed in 2.2.4 Patch available CNA
  • dagu (npm) Vendor— Affected before 2.2.4 Fixed in 2.2.4 Patch available GHSA-9wmw-9wph-2vwp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dagu:dagu:*:*:*:*:*:*:*:*before 2.2.4Vulnerabledagu-org
  • cpe:2.3:a:dagu:dagu:*:*:*:*:*:*:*:* Versions before 2.2.4 Vulnerable ·dagu-org

Remediation

  • Fix · CNA dagu (dagu-org) Fixed in 2.2.4
  • Fix · GHSA-9wmw-9wph-2vwp dagu (npm) Fixed in 2.2.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-31882
  2. 2026-10-03 Alias added: GHSA-9wmw-9wph-2vwp

References

Exploit 1

Patch 2

Advisory 1

Other 2

  • TI-2026-24438 Dagu has a Path Traversal via `dagRunId` in Inline DAG Execution CVSS 3.1CRITICAL 9.1
  • TI-2026-21984 Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory CVSS 4.0HIGH 7.1
  • TI-2026-25750 Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences