Dagu is a workflow engine that delivers real‑time data via Server‑Sent Events (SSE) in its web interface. When configured with HTTP Basic authentication (DAGU_AUTH_MODE=basic), the authentication middleware incorrectly marks SSE endpoints as not requiring credentials because the AuthRequired flag defaults to false. As a result, unauthenticated users can connect to any SSE endpoint and read real‑time execution data, workflow configurations, execution logs, and queue status, effectively bypassing the REST API’s authentication layer. The weakness is a credential‑related issue (CWE‑306).

The vulnerability affects all releases of the Dagu workflow engine from dagu-org prior to version 2.2.4. Any instance running a version earlier than 2.2.4 with Basic authentication enabled is susceptible. Users should verify their Dagu version and upgrade if necessary.

The CVSS Base Score is 7.5, indicating a medium‑high severity. The EPSS score is below 1%, suggesting low current exploitation probability, but the vulnerability is publicly documented and could be leveraged by an attacker with network access to the SSE endpoints. It is not listed in the CISA KEV catalog. An attacker requires only unauthenticated HTTP(S) connectivity to the server to exploit the flaw and gain sensitive information; no privileged access or code execution is required.