Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

dagu

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5npmAmendedPublished

    Dagu: SSE Authentication Bypass in Basic Auth Mode

    CVE-2026-31882 · GHSA-9wmw-9wph-2vwp

    Affected
    • npm dagu < 2.2.4
    Fixed in
    2.2.4· Vendor fix available
    Issue
    SSE Authentication Bypass in Basic Auth Mode Summary When Dagu is configured with HTTP Basic authentication (DAGUAUTHMODE=basic), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG execution data, workflow configurations, execution logs, and queue status — bypassing the authentication that protects the REST API. Severity HIGH (CVSS 3.1: 7.5 — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Affected Versions - dagu v2.2.3 (latest) and likely all versions with basic auth support Affected Component internal/service/frontend/server.go — buildStreamAuthOptions() function (lines 1177–1201) Root Cause The buildStreamAuthOptions() function builds authentication options for SSE/streaming endpoints. When the auth mode is basic, it returns an auth.Options struct with BasicAuthEnabled: true but AuthRequired defaults to false (Go zero value): The authentication middleware at…

    Recommended action: Upgrade to 2.2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →