GHSA-5m6c-38r8-5w76: Dagu MCP DAG specification read bypasses path containment and workspace isolation
Dagu is a workflow engine with a built-in Web user interface. Prior to version 2.11.0, its MCP daguread operation with target dagspec invokes the DAG specification API directly, bypassing the HTTP middleware introduced for CVE-2026-33344. The underlying resolver does not restrict resolved paths to configured DAG directories. An authenticated attacker with a viewer-role API key can supply an absolute or traversing path to read .yaml or .yml files outside those directories that are accessible to the Dagu process. The affected operation does not provide write or execution capability. This issue is fixed in version 2.11.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Daguto a version that resolves this vulnerability.Fixed in 2.11.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker with a viewer-role API key can exploit it. The attacker must be able to invoke the MCP dagu_read operation with target dag_spec.
What data can be exposed?
The attacker can read YAML files with .yaml or .yml extensions outside the configured DAG directories, provided those files are accessible to the Dagu process. The issue does not provide write or workflow-execution capability.
Are default path restrictions sufficient to prevent exploitation?
No. The affected operation bypasses the HTTP middleware intended to enforce path containment, and its underlying resolver does not restrict resolved paths to configured DAG directories.
What version fixes the issue?
Upgrade Dagu to version 2.11.0. Versions before 2.11.0 are affected.