Most recent entries from all

EUVD-2026-276019

fkie_cve-2026-31882

Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication (DAGU_AUTH_MODE=basic), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG execution data, workflow configurations, execution logs, and queue status — bypassing the authentication that protects the REST API. The buildStreamAuthOptions() function builds authentication options for SSE/streaming endpoints. When the auth mode is basic, it returns an auth.Options struct with BasicAuthEnabled: true but AuthRequired defaults to false (Go zero value). The authentication middleware at internal/service/frontend/auth/middleware.go allows unauthenticated requests when AuthRequired is false. This vulnerability is fixed in 2.2.4.

GHSA-9wmw-9wph-2vwp — Dagu: SSE Authentication Bypass in Basic Auth Mode

Affected: npm: dagu

# SSE Authentication Bypass in Basic Auth Mode

## Summary

When Dagu is configured with HTTP Basic authentication (`DAGU_AUTH_MODE=basic`), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG execution data, workflow configurations, execution logs, and queue status — bypassing the authentication that protects the REST API.

## Severity

**HIGH** (CVSS 3.1: 7.5 — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

## Affected Versions

- dagu v2.2.3 (latest) and likely all versions with basic auth support

## Affected Component

`internal/service/frontend/server.go` — `buildStreamAuthOptions()` function (lines 1177–1201)

## Root Cause

The `buildStreamAuthOptions()` function builds authentication options for SSE/streaming endpoints. When the auth mode is `basic`, it returns an `auth.Options` struct with `BasicAuthEnabled: true` but `AuthRequired` defaults to `false` (Go zero value):

```go // server.go:1195-1201 if authCfg.Mode == config.AuthModeBasic { return auth.Options{ Realm: realm, BasicAuthEnabled: true, Creds: map[string]string{authCfg.Basic.Username: authCfg.Basic.Password}, // AuthRequired is NOT set — defaults to false } } ```

The authentication middleware at `internal/service/frontend/auth/middleware.go:181-183` allows unauthenticated requests when `AuthRequired` is false:

```go // No credentials provided // If auth is not re…