Dagu: SSE Authentication Bypass in Basic Auth Mode
Date: 2026-03
Affected: npm/dagu
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-31882
CWE: CWE-306
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

# SSE Authentication Bypass in Basic Auth Mode ## Summary When Dagu is configured with HTTP Basic authentication (`DAGU_AUTH_MODE=basic`), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG execution data, workflow configurations, execution logs, and queue status — bypassing the authentication that protects the REST API. ## Severity **HIGH** (CVSS 3.1: 7.5 — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) ## Affected Versions - dagu v2.2.3 (latest) and likely all versions with basic auth support ## Affected Component `internal/service/frontend/server.go` — `buildStreamAuthOptions()` function (lines 1177–1201) ## Root Cause The `buildStreamAuthOptions()` function builds authentication options for SSE/streaming endpoints. When the auth mode is `basic`, it returns an `auth.Options` struct with `BasicAuthEnabled: true` but `AuthRequired` defaults to `false` (Go zero value): ```go // server.go:1195-1201 if authCfg.Mode == config.AuthModeBasic { return auth.Options{ Realm: realm, BasicAuthEnabled: true, Creds: map[string]string{authCfg.Basic.Username: authCfg.Basic.Password}, // AuthRequired is NOT set — defaults to false } } ``` The authentication middleware at `internal/service/frontend/auth/middleware.go:181-183` allows unauthenticated requests when `AuthRequired` is false: ```go // No credentials provided // If auth is not req


Mitigations:

Architectural layers (MAESTRO):