Skip to content
OpenAdvisories

Vendor

daytonaio

6 known vulnerabilities.

Products

daytona 6
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.2
    CVE-2026-54319

    Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape

    Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.186, a sandbox volume reference (volumeId, which may also be a volume name) was forwarded to the runner and used to build the host bind-moun…

    daytonaio daytona github.com/daytonaio/daytona Go
  • Medium 6.5
    CVE-2026-54324

    Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join

    Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, a cross-tenant authorization flaw in Daytona's notification WebSocket gateway allowed any authenticated user to subscribe to another …

    daytonaio daytona github.com/daytonaio/daytona Go
  • Medium 5.9
    CVE-2026-54323

    Daytona: Git credential leak via git clone with TLS verification disabled

    Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, the daemon's git clone implementation disabled TLS certificate verification. When a clone request carried Git credentials, the daemon…

    daytonaio daytona