CVE-2026-102943

Dagu is a workflow engine with a built-in Web user interface. Prior to version 2.11.0, its MCP daguread operation with target dagspec invokes the DAG specification API directly, bypassing the HTTP middleware introduced for CVE-2026-33344. The underlying resolver does not restrict resolved paths...