GHSA-6qr9-g2xw-cw92 Dagu affected by unauthenticated RCE via inline DAG spec in default configuration

Not scored Published 19 Feb 2026

Unauthenticated attackers can execute arbitrary OS commands on Dagu instances via the API due to disabled authentication in the default configuration.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is GHSA-6qr9-g2xw-cw92?

GHSA-6qr9-g2xw-cw92 is a command injection vulnerability in github.com/dagu-org/dagu, published on 19 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Summary

Dagu's default configuration ships with authentication disabled. The POST /api/v2/dag-runs endpoint accepts an inline YAML spec and executes its shell commands immediately with no credentials required — any dagu instance reachable over the network is fully compromised by default.

Details

internal/service/app/config/loader.go:226 sets AuthModeNone as the default. With no auth mode configured, internal/frontend/api/v2/handlers/api.go:520 returns nil from requireExecute() — all permission checks pass without a valid session.

The POST /api/v2/dag-runs endpoint accepts a spec field containing a full YAML DAG definition. The spec is parsed and the commands execute immediately on the host with no validation beyond YAML parsing.

PoC

curl -s -X POST http://TARGET:8080/api/v2/dag-runs \
  -H &#34;Content-Type: application/json&#34; \
  -d &#39;{&#34;name&#34;:&#34;poc&#34;,&#34;spec&#34;:&#34;steps:\n  - name: rce\n    command: id &gt; /tmp/pwned\n&#34;}&#39;
# Response: {&#34;dagRunId&#34;:&#34;&lt;uuid&gt;&#34;}
# /tmp/pwned contains: uid=1000(dagu) gid=1000(dagu)

Confirmed on ghcr.io/dagu-org/dagu:latest with no configuration changes.

Impact

Every dagu deployment using default settings — every Docker deployment, every install following the documentation, every instance without explicit DAGU_AUTH_MODE configuration — is fully compromised without credentials. An attacker with network access gets OS command execution as the dagu process user.

Which versions are affected by GHSA-6qr9-g2xw-cw92?

3 open source packages ship an affected version, including github.com/dagu-org/dagu.

Package	Affected	Fixed in
`github.com/dagu-org/dagu` Go	All versions	None
`github.com/dagu-org/dagu` Go	All versions to `1.30.3`	None
`github.com/dagu-org/dagu` Go	All versions to `1.30.3`	None

How do I fix GHSA-6qr9-g2xw-cw92?

No fix has been published for GHSA-6qr9-g2xw-cw92 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is GHSA-6qr9-g2xw-cw92 being exploited?

There is no known exploitation of GHSA-6qr9-g2xw-cw92 in the wild and no public exploit code.

Sources

Also known as GO-2026-4527.