CVE-2026-102943

Dagu’s MCP read path bypasses its HTTP file guard

Dagu · Dagu MCP DAG specification access

First documented disclosure · Review checkpoint

Summary

A viewer can read YAML files outside configured workflow directories.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: A researcher reproduced reads with the project’s live test harness and a viewer key; malicious use is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The MCP service calls GetDAGSpec directly, skipping REST middleware; the file resolver accepts escaping paths and the handler omits workspace visibility checks.

Conditions required

Access to the MCP service with a viewer-role API key, and a readable .yaml or .yml target.

Potential impact

Read-only disclosure of YAML content and crossing of workspace boundaries. The report did not establish writes or execution.

Affected versions and configurations

CNA: before 2.11.0; maintainer reproduction used a post-2.10.7 snapshot.

Fix and mitigation status

2.11.0 constrains resolution at the shared storage boundary.

Practical next steps

Upgrade and review MCP viewer access. Remove secrets from readable workflow/configuration files and rotate any credentials whose exposure is suspected.

Operating lesson

Apply path and authorization checks where every transport converges.

Evidence and limits

Public PR 2424 on July 25 predates the July 26 advisory and November 5 CVE. This residual MCP issue is separate from the earlier REST middleware fix.

Sources