# CVE-2026-102943: Dagu MCP DAG specification read bypasses path containment and workspace isolation

Status: published. Published: 2026-11-05. Updated: 2026-11-05.

Dagu is a workflow engine with a built-in Web user interface. Prior to version 2.11.0, its MCP  dagu_read  operation with target  dag_spec  invokes the DAG specification API directly, bypassing the HTTP middleware introduced for CVE-2026-33344. The underlying resolver does not restrict resolved paths to configured DAG directories. An authenticated attacker with a viewer-role API key can supply an absolute or traversing path to read  .yaml  or  .yml  files outside those directories that are accessible to the Dagu process. The affected operation does not provide write or execution capability. This issue is fixed in version 2.11.0.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- dagucloud / dagu: < 2.11.0 (affected). Source: CNA: GitHub_M

## Severity and prioritization

- CVSS 3.1: 6.5 (medium); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-22, CWE-863

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/dagucloud/dagu/security/advisories/GHSA-5m6c-38r8-5w76 (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/dagucloud/dagu/pull/2424 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/dagucloud/dagu/commit/c15c5406bb7b9551f94ab276705f9fd1cebbf2d2 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/dagucloud/dagu/releases/tag/v2.11.0 (CNA: GitHub_M; x_refsource_MISC)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-102943; retrieved 2026-11-05; source updated 2026-11-05

Revision: 91ef5bddf49035204883c9045277b6649b4bf46a0fc5de3a91db640e904f44b9

Canonical: https://y2.dev/cve/CVE-2026-102943

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.