CVE-2026-31882 Dagu SSE Authentication Bypass in Basic Auth Mode
Unauthenticated attackers can access real-time workflow data and logs via SSE endpoints when Basic Auth is enabled, bypassing authentication controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31882?
CVE-2026-31882 is a high-severity authentication bypass vulnerability in dagu-org dagu, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication (DAGU_AUTH_MODE=basic), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG execution data, workflow configurations, execution logs, and queue status — bypassing the authentication that protects the REST API. The buildStreamAuthOptions() function builds authentication options for SSE/streaming endpoints. When the auth mode is basic, it returns an auth.Options struct with BasicAuthEnabled: true but AuthRequired defaults to false (Go zero value). The authentication middleware at internal/service/frontend/auth/middleware.go allows unauthenticated requests when AuthRequired is false. This vulnerability is fixed in 2.2.4.
Weakness: CWE-306
Which versions are affected by CVE-2026-31882?
2 open source packages ship an affected version, including dagu. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dagu npm | All versions | 2.2.4 |
dagu npm | All versions | 2.2.4 |
Products include Dagu Dagu.
How do I fix CVE-2026-31882?
Upgrade dagu to 2.2.4 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-31882 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31882 exists.
Other vulnerabilities in dagu-org dagu
- CVE-2026-31886 Dagu has a Path Traversal via `dagRunId` in Inline DAG Execution
- CVE-2026-33344 Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG
- CVE-2026-27598 Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory
Sources
Also known as GHSA-9wmw-9wph-2vwp.