CVE-2026-31882

Katalog CVE

CVSS 7.5 · High EPSS 0,77%

Kerentanan Missing Authentication for Critical Function pada dagu. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication (DAGU_AUTH_MODE=basic), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG execution data, workflow configurations, execution logs, and queue status — bypassing the authentication that protects the REST API. The buildStreamAuthOptions() function builds authentication options for SSE/streaming endpoints. When the auth mode is basic, it returns an auth.Options struct with BasicAuthEnabled: true but AuthRequired defaults to false (Go zero value). The authentication middleware at internal/service/frontend/auth/middleware.go allows unauthenticated requests when AuthRequired is false. This vulnerability is fixed in 2.2.4.

Rincian

Terbit di NVD

13 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dagu-org/dagu/security/advisories/GHSA-9wmw-9wph-2vwp exploit · mitigasi · advisory vendor
• https://github.com/dagu-org/dagu/commit/064616c9b80c04824c1c7c357308f77f3f24d775 patch
• https://github.com/dagu-org/dagu/pull/1752 issue tracking · patch
• https://github.com/dagu-org/dagu/releases/tag/v2.2.4 product · release notes