CVE-2026-31882

Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication DAGUAUTHMODE=basic, all Server-Sent Events SSE endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG...

CVE-2026-31882

Summary: CVE-2026-31882 affects Dagu, a workflow engine. Before v2.2.4, when DAGU_AUTH_MODE=basic, SSE endpoints are accessible without credentials, allowing unauthenticated access to real-time DAG data, configurations, logs, and queue status via a flaw in buildStreamAuthOptions() where BasicAuth...

CVE-2026-31882

creationtimestamp| type| source ---|---|--- 2026-03-13 07:10:32+00:00| published-proof-of-concept| https://github.com/dagucloud/dagu/security/advisories/GHSA-9wmw-9wph-2vwp 2026-03-18 21:20:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mheg44u7dn2a...