CVE-2026-31882: falha de alta gravidade em dagu-org dagu
Dagu SSE Authentication Bypass in Basic Auth Mode
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.8%
Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication (DAGU_AUTH_MODE=basic), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG execution data, workflow configurations, execution logs, and queue status — bypassing the authentication that protects the REST API. The buildStreamAuthOptions() function builds authentication options for SSE/streaming endpoints. When the auth mode is basic, it returns an auth.Options struct with BasicAuthEnabled: true but AuthRequired defaults to false (Go zero value). The authentication middleware at internal/service/frontend/auth/middleware.go allows unauthenticated requests when AuthRequired is false. This vulnerability is fixed in 2.2.4.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
dagu-org · daguCVEs relacionadas — dagu-org dagu
No mesmo produto, das mais perigosas para as menos.
CVE-2026-27598HIGHDagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directoryEPSS 0.6%CVE-2026-33344HIGHDagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAGEPSS 0.5%CVE-2026-31886CRITICALDagu has a Path Traversal via `dagRunId` in Inline DAG ExecutionEPSS 0.4%