---
title: "GHSA-6qr9-g2xw-cw92: Dagu affected by unauthenticated RCE via inline DAG spec in default configuration"
url: https://erroneo.us/security/ghsa/GHSA-6qr9-g2xw-cw92/
description: "GHSA-6qr9-g2xw-cw92 (critical, Go): Dagu affected by unauthenticated RCE via inline DAG spec in default configuration. Summary Dagu's default configuration…"
type: advisory
section: "Security Digest"
date_published: 2026-02-19
date_modified: 2026-02-20
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-6qr9-g2xw-cw92"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-6qr9-g2xw-cw92: Dagu affected by unauthenticated RCE via inline DAG spec in default configuration

## Affected packages

- Go `github.com/dagu-org/dagu` <= 1.30.3 → fixed: none listed

## Details

Summary Dagu's default configuration ships with authentication disabled. The POST /api/v2/dag-runs endpoint accepts an inline YAML spec and executes its shell commands immediately with no credentials required — any dagu instance reachable over the network is fully compromised by default. Details internal/service/app/config/loader.go:226 sets AuthModeNone as the default. With no auth mode configured, internal/frontend/api/v2/handlers/api.go:520 returns nil from requireExecute() — all permission checks pass without a valid session. The POST /api/v2/dag-runs endpoint accepts a spec field containing a full YAML DAG definition. The spec is parsed and the commands execute immediately on the host with no validation beyond YAML parsing. PoC Confirmed on ghcr.io/dagu-org/dagu:latest with no configuration changes. Impact Every dagu deployment using default settings — every Docker deployment, every install following the documentation, every instance without explicit DAGUAUTHMODE configuration — is fully compromised without credentials. An attacker with network access gets OS command execution as the dagu process user.

## Sources

- [GitHub Advisory GHSA-6qr9-g2xw-cw92](https://github.com/advisories/GHSA-6qr9-g2xw-cw92)
- [github.com](https://github.com/dagu-org/dagu/security/advisories/GHSA-6qr9-g2xw-cw92)

---
Source page: https://erroneo.us/security/ghsa/GHSA-6qr9-g2xw-cw92/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt