{"data":{"id":"30eb39af-d21a-48a6-9162-fd7ae1dd537e","title":"CVE-2026-54323: Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to…","summary":"Daytona, an infrastructure runtime for AI-generated code execution and agent workflows, prior to 0.185.0 disabled TLS certificate verification in the daemon's git clone implementation on both the go-git and native git CLI code paths. When a clone request carried Git credentials, the daemon sent the HTTP Basic Authorization header over an unvalidated connection. An attacker able to intercept clone traffic could present any TLS certificate, capture those credentials, and serve tampered repository content into the sandbox.","solution":"Fixed in 0.185.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54323","publishedAt":"2026-06-23T18:18:09.017Z","cveId":"CVE-2026-54323","cweIds":["CWE-295"],"cvssScore":"5.9","cvssSeverity":"medium","severity":"medium","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Daytona"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Daytona git clone skips TLS certificate verification, exposing credentials","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","attackVector":"network","attackComplexity":"high","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00185,"epssCheckedAt":"2026-11-09T12:10:44.315Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T00:09:38.152Z","patchAvailable":null,"disclosureDate":"2026-06-23T18:18:09.017Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}