Dagu's Default Execution Path Turns Exposure Into Command Execution
A workflow orchestrator is designed to run commands. When its management interface is reachable without authentication, the exposure is not limited to reading schedules. The service can become an execution endpoint for anything the Dagu process is allowed to run.
A critical default configuration issue
GitHub Advisory GHSA-6qr9-g2xw-cw92, published in February 2026, describes Dagu's default configuration as shipping with authentication disabled. The advisory says the POST /api/v2/dag-runs endpoint accepts an inline YAML DAG specification and executes its shell commands immediately without credentials. It lists affected versions of github.com/dagu-org/dagu through 1.30.3 and no patched version at the time of the advisory.
The Dagu repository documentation now lists authentication modes including none, basic, and builtin. The builtin mode provides JWT authentication with user management, API keys, per-DAG webhook tokens, and optional OIDC/SSO. The existence of stronger modes does not prove what a deployed instance uses.
The measurement
On 2026-11-06 08:46:22 +08:00, ZoomEye count-only queries used sub_type=all, page 1, and pagesize 1. app="Dagu" returned 0 matches, title="Dagu" returned 132, and http.body="Dagu" returned 1,512. The title count is small compared with broad SaaS populations, but the consequence of an exposed execution plane can be high. The query does not prove that any matching host is Dagu or that the advisory applies.
Treat reachability as an emergency control
For an owned deployment, determine the exact version, authentication mode, listen address, reverse proxy policy, and container permissions. If the service is reachable from an untrusted network and authentication is disabled, isolate it first, then investigate. Preserve logs and running workflow state before restarting or rebuilding the host.
Review process credentials, mounted secrets, Docker sockets, Kubernetes service-account tokens, and the privileges available to workflow commands. Dagu workflows can call shell commands, containers, Kubernetes jobs, SQL, and HTTP endpoints. The impact of unauthorized execution depends on that environment, not only on the Dagu UI.
Verify the replacement configuration
Move authentication to a deliberate mode, terminate TLS at a trusted boundary, and restrict the management interface to an administrative network. If OIDC is used, verify issuer, audience, redirect URI, and group mapping. Test that an unauthenticated request cannot create or inspect a run. Then confirm that authorized users cannot exceed their intended project or workflow scope.
Alert on new runs, changes to DAG definitions, webhook token creation, and authentication-mode changes. A local health endpoint may be expected to work without login; the management and execution endpoints should not.
Top comments (0)