Description

Dagu is a workflow engine with a built-in Web user interface. Prior to version 2.11.0, its MCP  dagu_read  operation with target  dag_spec  invokes the DAG specification API directly, bypassing the HTTP middleware introduced for CVE-2026-33344. The underlying resolver does not restrict resolved paths to configured DAG directories. An authenticated attacker with a viewer-role API key can supply an absolute or traversing path to read  .yaml  or  .yml  files outside those directories that are accessible to the Dagu process. The affected operation does not provide write or execution capability. This issue is fixed in version 2.11.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-05T23:16:49.180Z",
  "pubdate": "2026-11-05T23:16:49.180Z",
  "executiveSummary": "Dagu versions prior to 2.11.0 are susceptible to an arbitrary file read vulnerability originating from insufficient path validation in the dag_read MCP operation.\nThe vulnerability allows an authenticated attacker possessing a viewer-role API key to bypass established security middleware and access sensitive .yaml or .yml files residing outside of the authorized DAG configuration directories.\nThis flaw represents a significant security risk, as it facilitates unauthorized information disclosure of system configurations or environment variables accessible to the Dagu process, despite the lack of direct write or code execution capabilities.\nExploitation requires active authentication with valid API credentials, meaning the impact is primarily restricted to environments where Dagu instances are reachable by malicious actors who have obtained or compromised low-privileged viewer accounts.",
  "technicalDetails": "The root cause of this vulnerability lies in a flaw within the Dagu workflow engine's MCP (Model Context Protocol) dag_read operation. Specifically, when processing a target dag_spec request, the system invokes the internal DAG specification API directly, effectively bypassing the security middleware that was implemented to mitigate CVE-2026-33344.\nThe internal resolver tasked with handling these requests fails to implement strict input validation or path normalization logic. Consequently, it does not enforce constraints to ensure that requested resources are contained within the predefined, secure DAG directories.\nAn authenticated attacker can exploit this by crafting a malicious payload containing absolute file paths or directory traversal sequences (e.g., ../ sequences). When the application processes this input, the underlying resolver fails to sanitize the path, allowing the Dagu process to access files located on the underlying host filesystem.\nBecause the operation is restricted to reading files with .yaml or .yml extensions, the attacker is limited to retrieving structured configuration files that the Dagu service process has the permission to read. While this does not permit remote code execution or file modification, the sensitivity of such configuration files—which often contain database credentials, API keys, or infrastructure topology details—results in a high-impact information disclosure incident.\nThe attack flow proceeds as follows: 1) An attacker authenticates to the Dagu Web UI or API using a valid viewer-role API key. 2) The attacker issues a request to the dag_read MCP operation, substituting the expected DAG name with a path-traversal payload or an absolute file path pointing to a target .yaml file. 3) The application, having bypassed the middleware checks, passes the raw path string directly to the internal API resolver. 4) The resolver proceeds to read the file contents from the requested location, bypassing logical directory restrictions. 5) The sensitive file content is returned to the attacker in the API response.\nThis vulnerability persists across all Dagu versions prior to 2.11.0. Mitigation involves updating the affected software to version 2.11.0, where the resolver logic has been corrected to properly validate paths and enforce strict directory containment."
}