Executive brief
Dagu is a workflow orchestration tool that manages scheduled data pipelines and jobs. When configured with HTTP Basic Authentication, all real-time event streaming endpoints (Server-Sent Events) are accessible without credentials, allowing unauthenticated attackers to view workflow configurations, execution logs, and system status that should be protected. This bypasses the authentication that protects the REST API and exposes sensitive data like API keys and database credentials embedded in logs.
Technical details
The vulnerability is an authentication bypass in the buildStreamAuthOptions() function (internal/service/frontend/server.go, lines 1177–1201) that configures SSE endpoint authentication. When auth mode is set to basic, the function sets BasicAuthEnabled: true but fails to set AuthRequired: true (it defaults to Go's zero value of false). The authentication middleware subsequently allows all unauthenticated requests to SSE endpoints when AuthRequired is false, despite the function enabling basic auth validation. All SSE routes (/api/v1/events/*) are affected, exposing DAG configurations, execution history, real-time run status, logs, and queue information. No authentication or user interaction is required; an attacker need only send unauthenticated HTTP requests to these network-accessible endpoints. A patch setting AuthRequired: true and implementing a session-token mechanism is suggested but not yet released.
Affected products
- Dagu Dagu v2.2.3 and likely all versions with basic auth support
Timeline
- 2026-03-13: disclosed
- other: GHSA-9wmw-9wph-2vwp published; CVE-2026-31882 assigned