CVE-2026-54321
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. From 0.101.0 until 0.184.0, sandbox previews that were switched from public to private could remain reachable without authentication for a short period after the change, due to a cached visibility state that was not invalidated when the sandbox's visibility changed. This vulnerability is fixed in 0.184.0.
- CVSS 3.1
- 7.0
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L - EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-613, CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-ww63-pv5x-vfc8 | Go | github.com/daytonaio/daytona | >=0.101.0 <0.184.0 | 0.184.0 |
| GO-2026-5729 | Go | github.com/daytonaio/daytona | >=0.101.0 <0.184.0 | 0.184.0 |