Path Traversal Vulnerability in Dagu Workflow Engine by DaguCloud

CVE-2026-102943

What is CVE-2026-102943?

The Dagu workflow engine prior to version 2.11.0 contains a security vulnerability in its MCP dagu_read operation. This flaw allows authenticated attackers with viewer-role API keys to leverage the DAG specification API directly, bypassing important HTTP middleware protections. As a result, malicious users can manipulate absolute or relative paths to access and read sensitive .yaml or .yml configuration files that reside outside the permitted DAG directories of the Dagu process. This vulnerability does not grant write or execution permissions, but it poses a significant threat by exposing potentially risky configuration data. The issue has been resolved in version 2.11.0.

References