CVE-2026-102943

The Dagu workflow engine (versions prior to 2.11.0 ) is vulnerable to a path traversal flaw in its MCP dagu_read operation with the dag_spec target. The vulnerability exists because the operation bypasses the HTTP middleware introduced for CVE-2026-33344 and uses a resolver that fails to restrict...