VulnerabilityDeferred

CVE-2026-54321

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows.

HIGH 7.0EPSS 0.40%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.40%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. From 0.101.0 until 0.184.0, sandbox previews that were switched from public to private could remain reachable without authentication for a short period after the change, due to a cached visibility state that was not invalidated when the sandbox's visibility changed. This vulnerability is fixed in 0.184.0.

CVSS 3.1: 7.0 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
EPSS: 0.40% probability · 33th percentile
CISA KEV: Not listed
Weakness: CWE-613, CWE-863
Source: security-advisories@github.com

References

https://github.com/daytonaio/daytona/security/advisories/GHSA-ww63-pv5x-vfc8

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.