CVE-2026-54324 — MEDIUM (6.5)

Vulnerability Description

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, a cross-tenant authorization flaw in Daytona's notification WebSocket gateway allowed any authenticated user to subscribe to another organization's realtime notification channel and passively receive that organization's events. This vulnerability is fixed in 0.185.0.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Related Weaknesses (CWE)

CWE-639 CWE-863

References

https://github.com/daytonaio/daytona/security/advisories/GHSA-qwxf-2m7m-2m3x

FAQ

What is CVE-2026-54324?

CVE-2026-54324 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, a cross-tenant authorization flaw in Daytona's notification WebSocket gate...

How severe is CVE-2026-54324?

CVE-2026-54324 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-54324?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.