CVE-2026-102943: Dagu MCP DAG specification read bypasses path containment and workspace isolation
Dagu is a workflow engine with a built-in Web user interface. Prior to version 2.11.0, its MCP daguread operation with target dagspec invokes the DAG specification API directly, bypassing the HTTP middleware introduced for CVE-2026-33344. The underlying resolver does not restrict resolved paths to configured DAG directories. An authenticated attacker with a viewer-role API key can supply an absolute or traversing path to read .yaml or .yml files outside those directories that are accessible to the Dagu process. The affected operation does not provide write or execution capability. This issue is fixed in version 2.11.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Daguto a version that resolves this vulnerability.Fixed in 2.11.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker with a viewer-role API key can exploit the affected MCP dagu_read operation when targeting dag_spec. The attacker must be able to submit an absolute path or a path containing traversal sequences.
What data could be exposed?
The attacker can read .yaml or .yml files outside the configured DAG directories, provided those files are accessible to the Dagu process. The issue does not provide write access or workflow execution capability.
Are deployments prior to 2.11.0 affected by default?
Versions prior to 2.11.0 contain the affected operation, but exploitation requires MCP dagu_read access, a viewer-role API key, and an accessible YAML file outside the configured DAG directories. The description does not establish whether MCP access is enabled by default.
What should be done if an immediate upgrade is not possible?
Restrict or revoke viewer-role API keys that can access the MCP dagu_read operation, and limit the Dagu process's filesystem permissions so it cannot read sensitive YAML files outside DAG directories. Upgrade to version 2.11.0 when possible.