Dagu MCP DAG specification read bypasses path containment

A traversal vulnerability in Dagu's MCP service allows reading arbitrary YAML files outside the configured workspace through direct API calls that bypass HTTP middleware protections. The vulnerability affects viewer-role API keys and is limited to read-only access of .yaml/.yml files.

Disclosed 10 November 2026 · Record updated 10 November 2026

Impact

Arbitrary read access to YAML files outside workspace boundaries via MCP service, bypassing HTTP middleware path containment checks

Our coverage

A locked door's security chain hangs loose while a mechanical hand reaches past it into shadowed filing cabinets, pulling folders the barrier was meant to prevent.

Vulnerabilities

Dagu's MCP tools reopen a patched path traversal flaw

An advisory published on 10 November 2026 says the workflow engine's agent interface skips the HTTP middleware that blocks arbitrary YAML file reads.

10 Nov 2026

Sources

github.comhttps://github.com/advisories/GHSA-5m6c-38r8-5w76