dagu vulnerabilities

CVEs whose affected-version data names the dagu package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-102943Medium· 6.5

2d ago

Dagu MCP DAG specification read bypasses path containment and workspace isolation

Dagu is a workflow engine with a built-in Web user interface. Prior to version 2.11.0, its MCP dagu_read operation with target dag_spec invokes the DAG specification API directly, bypassing the HTTP middleware introduced for CVE-2026…

▾ Sunlitdagucloud · daguEPSS 0.41%via CVEORG