{"repro_id":"REPRO-2026-00106","version":6,"title":"Dagu Unauthenticated RCE via Inline DAG Spec","repro_type":"security","status":"published","severity":"critical","description":"Dagu's default configuration ships with authentication completely disabled. The POST /api/v2/dag-runs endpoint accepts an inline YAML spec and executes shell commands immediately without authentication.","root_cause":"Dagu's default configuration ships with authentication completely disabled. The POST /api/v2/dag-runs endpoint accepts an inline YAML spec and executes shell commands immediately without authentication.","ghsa_id":"GHSA-6qr9-g2xw-cw92","cwe_id":"CWE-306 (Missing Authentication for Critical Function)","package":{"name":"github.com/dagu-org/dagu","ecosystem":"go","affected_versions":"<= 1.30.3"},"reproduced_at":"2026-02-20T15:03:08.495162+00:00","duration_secs":1118.1474437713623,"tool_calls":153,"turns":112,"handoffs":2,"total_cost_usd":0.7727976999999998,"agent_costs":{"repro":0.2290955,"support":0.0220472,"vuln_variant":0.5216550000000001},"cost_breakdown":{"repro":{"accounts/fireworks/models/kimi-k2p5":0.2290955},"support":{"accounts/fireworks/models/kimi-k2p5":0.0220472},"vuln_variant":{"accounts/fireworks/models/kimi-k2p5":0.5216550000000001}},"quality":{"idempotent_verified":false,"community_verifications":0},"published_at":"2026-02-20T15:03:10.481876+00:00","retracted":false,"artifacts":[{"path":"repro/rca_report.md","filename":"rca_report.md","size":6444,"category":"analysis"},{"path":"repro/reproduction_steps.sh","filename":"reproduction_steps.sh","size":4088,"category":"reproduction_script"},{"path":"bundle/source.json","filename":"source.json","size":6255,"category":"other"},{"path":"bundle/ticket.json","filename":"ticket.json","size":10897,"category":"other"},{"path":"bundle/ticket.md","filename":"ticket.md","size":4150,"category":"ticket"},{"path":"logs/dagu_fixed_server.log","filename":"dagu_fixed_server.log","size":155,"category":"log"},{"path":"logs/dagu_server.log","filename":"dagu_server.log","size":1580,"category":"log"},{"path":"logs/dagu_variant_server.log","filename":"dagu_variant_server.log","size":2328,"category":"log"},{"path":"logs/docker_run.log","filename":"docker_run.log","size":194,"category":"log"},{"path":"logs/exploit_response.log","filename":"exploit_response.log","size":52,"category":"log"},{"path":"logs/final_server.log","filename":"final_server.log","size":1407,"category":"log"},{"path":"logs/variant_test.log","filename":"variant_test.log","size":192,"category":"log"},{"path":"logs/verification.log","filename":"verification.log","size":29,"category":"log"}]}