High severity7.0GHSA Advisory· Published Jun 23, 2026· Updated Jun 25, 2026

CVE-2026-54321

Description

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. From 0.101.0 until 0.184.0, sandbox previews that were switched from public to private could remain reachable without authentication for a short period after the change, due to a cached visibility state that was not invalidated when the sandbox's visibility changed. This vulnerability is fixed in 0.184.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/daytonaio/daytonaGo	>= 0.101.0, < 0.184.0	0.184.0

Affected products

osv-coords
pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
Range: < 0.0.20260723T184607-160000.1.1
Daytonaio/DaytonaGHSA
Range: >= 0.101.0, <= 0.183.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-ww63-pv5x-vfc8ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-54321ghsaADVISORY
github.com/daytonaio/daytona/security/advisories/GHSA-ww63-pv5x-vfc8nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000