Medium severity6.5NVD Advisory· Published Jun 23, 2026· Updated Jun 25, 2026

CVE-2026-54324

Description

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, a cross-tenant authorization flaw in Daytona's notification WebSocket gateway allowed any authenticated user to subscribe to another organization's realtime notification channel and passively receive that organization's events. This vulnerability is fixed in 0.185.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/daytonaio/daytonaGo	< 0.185.0	0.185.0

Affected products

osv-coords2 versions
pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0 pkg:golang/github.com/daytonaio/daytona
< 0.0.20260723T184607-160000.1.1+ 1 more
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
- (no CPE)range: < 0.185.0
Daytonaio/Daytonallm-fuzzy
Range: >=0.101.0, <=0.184.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-qwxf-2m7m-2m3xghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-54324ghsaADVISORY
github.com/daytonaio/daytona/security/advisories/GHSA-qwxf-2m7m-2m3xnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000