7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31882

CVE-2026-31882: Dagu SSE Authentication Bypass in Basic Auth Mode

Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication (DAGU_AUTH_MODE=basic), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG execution data, workflow configurations, execution logs, and queue status — bypassing the authentication that protects the REST API. The buildStreamAuthOptions() function builds authentication options for SSE/streaming endpoints. When the auth mode is basic, it returns an auth.Options struct with BasicAuthEnabled: true but AuthRequired defaults to false (Go zero value). The authentication middleware at internal/service/frontend/auth/middleware.go allows unauthenticated requests when AuthRequired is false. This vulnerability is fixed in 2.2.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31882

CVE-2026-31882:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
dagu	npm	< 2.2.4	2.2.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an authentication bypass for Server-Sent Events (SSE) endpoints in Dagu when basic authentication is enabled. The root cause was traced to the buildStreamAuthOptions function in internal/service/frontend/server.go. This function is responsible for generating the authentication configuration for streaming endpoints.

The analysis of the provided patch, commit 064616c9b80c04824c1c7c357308f77f3f24d775, confirms this. Before the patch, when the authentication mode was 'basic', the function returned an auth.Options struct without explicitly setting the AuthRequired field. In Go, boolean fields default to false. This misconfiguration was consumed by the authentication middleware, which then incorrectly allowed unauthenticated requests to access sensitive SSE endpoints.

The fix was to add the line AuthRequired: true within the auth.Options struct for the basic authentication case. This ensures that the authentication middleware correctly enforces credential checks for all SSE endpoints, mitigating the vulnerability.

Vulnerable functions

Server.buildStreamAuthOptions

internal/service/frontend/server.go

This function constructs authentication options for SSE (Server-Sent Events) endpoints. When Dagu is configured for 'basic' authentication, this function failed to set the 'AuthRequired' flag to true. The flag's default value of false caused the authentication middleware to permit unauthenticated access to all SSE endpoints, leading to an information disclosure vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.