Unauthenticated attackers can access sensitive workflow execution data and logs in Dagu versions prior to 2.2.4 due to an authentication bypass vulnerability.

This flaw stems from a missing authentication check in the Server-Sent Events (SSE) streaming endpoints. When HTTP Basic authentication is enabled, the buildStreamAuthOptions function fails to set the required authentication flag, allowing unauthenticated users to access real-time execution logs and workflow configurations.

Successful exploitation allows unauthorized third parties to gain visibility into sensitive business processes, workflow configurations, and potentially sensitive execution logs. With a CVSS score of 7.5, this high-severity vulnerability poses a significant risk to operational integrity and data privacy, as it exposes the internal state of automated workflows to unauthenticated actors.

Immediate Action: Update the Dagu workflow engine to version 2.2.4 or later immediately.

Proactive Monitoring: Review access logs for unauthorized requests to SSE or streaming endpoints that do not originate from authenticated sessions.

Compensating Controls: If an immediate update is not feasible, restrict network access to the Dagu web interface using a VPN or IP allowlisting to prevent external exposure.

Public Exploit Available: Unknown.

Given the exposure of sensitive workflow data, organizations utilizing Dagu with Basic authentication must prioritize upgrading to version 2.2.4. Failure to patch allows persistent, unauthenticated access to system internals, which could facilitate further reconnaissance and compromise of the underlying business logic.