What happened
Dagu's MCP dagu_read path bypasses the HTTP middleware added to contain the earlier CVE-2026-33344, and the path resolver does not restrict results to configured DAG directories. A read-only (viewer) MCP caller can read arbitrary yaml/yml files accessible to the Dagu process.
Why it matters
It is a read-only information-disclosure path in a workflow engine's MCP surface, reachable by a low-privilege authenticated caller; it does not permit write or execution but can leak configuration or other yaml files from the host.
Attack vector
The MCP dagu_read operation with target dag_spec invokes the DAG specification API directly, bypassing the HTTP middleware introduced for CVE-2026-33344; the underlying resolver does not restrict resolved paths to configured DAG directories. An authenticated attacker with a viewer-role API key can supply an absolute or traversing path to read .yaml/.yml files outside those directories.
Affected systems
Dagu < 2.11.0
Mitigation
Upgrade to Dagu 2.11.0. Advisory: https://github.com/dagucloud/dagu/security/advisories/GHSA-5m6c-38r8-5w76