GHSA-5m6c-38r8-5w76: Dagu MCP DAG specification read bypasses path containment and workspace isolation

Summary

The fix for CVE-2026-33344 is installed only in the chi HTTP handler chain, so the MCP service's in-process call to GetDAGSpec bypasses it. The dagu_read tool with target dag_spec can therefore read arbitrary .yaml/.yml files by absolute path, including with a viewer-role key, and it also crosses workspace isolation because GetDAGSpec skips the requireWorkspaceVisible check. The defect was confirmed at HEAD f6c039f, after v2.10.7.

Mitigation

The source suggests moving the containment check out of HTTP middleware and into locateDAG, rejecting any resolved path that does not fall under baseDir or a configured search path. It also suggests adding requireWorkspaceVisible to GetDAGSpec to match its sibling handlers.

Topics

• Model Context Protocol

Related items

• HighCVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name NormalizationSimilar attack · AWS Security Bulletins
• HighGHSA-ghwv-vrp2-2975: Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU AttacksSimilar attack · GitHub Advisory Database
• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• InfoSuppression Is Not Erasure: Mechanistic Analysis and Reactivation Boundaries of Subspace Projection for LoRA Backdoor DefenseSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)