CVE-2026-31882
Authentication Bypass in Dagu SSE Endpoints Exposes Sensitive Data
Publication date: 2026-03-13
Last updated on: 2026-03-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dagu | dagu | to 2.2.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Dagu, a workflow engine with a built-in Web user interface. Before version 2.2.4, when Dagu is set to use HTTP Basic authentication, all Server-Sent Events (SSE) endpoints can be accessed without requiring any credentials.
This means that unauthenticated attackers can bypass the authentication protecting the REST API and gain access to sensitive real-time data such as DAG execution data, workflow configurations, execution logs, and queue status.
The root cause is that the authentication middleware allows unauthenticated requests to SSE endpoints because the AuthRequired flag defaults to false, even when BasicAuthEnabled is true. This issue was fixed in version 2.2.4.
How can this vulnerability impact me? :
This vulnerability can allow attackers to access sensitive and real-time workflow execution data without authentication.
- Exposure of DAG execution data
- Access to workflow configurations
- Viewing execution logs
- Monitoring queue status
Such unauthorized access could lead to information disclosure and potentially aid attackers in further exploiting the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Dagu to version 2.2.4 or later, where the issue is fixed.
Avoid using HTTP Basic authentication (DAGU_AUTH_MODE=basic) with versions prior to 2.2.4, as SSE endpoints are accessible without credentials in those versions.