{"data":{"id":"b68af9b0-d39d-4642-96d5-fdd769af4ae7","title":"CVE-2026-54321: Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. From…","summary":"CVE-2026-54321 affects Daytona from 0.101.0 until 0.184.0. Sandbox previews switched from public to private could stay reachable without authentication for a short period, because a cached visibility state was not invalidated when the sandbox's visibility changed. The weakness is classified as CWE-613 (Insufficient Session Expiration) and CWE-863 (Incorrect Authorization).","solution":"This vulnerability is fixed in 0.184.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54321","publishedAt":"2026-06-23T19:17:08.190Z","cveId":"CVE-2026-54321","cweIds":["CWE-613","CWE-863"],"cvssScore":"7","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/daytonaio/daytona@>= 0.101.0, <= 0.183.0 (fixed: 0.184.0)"],"affectedPackageNames":["github.com/daytonaio/daytona"],"affectedPackageRefs":["go:github.com/daytonaio/daytona"],"affectedVendors":[],"affectedVendorsRaw":["Daytona"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Daytona sandbox previews reachable without authentication when private","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","attackVector":"network","attackComplexity":"high","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00398,"epssCheckedAt":"2026-11-10T00:11:22.622Z","kevDateAdded":null,"advisoryAliases":["GHSA-ww63-pv5x-vfc8"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:47:31.538Z","patchAvailable":true,"disclosureDate":"2026-06-23T19:17:08.190Z","fixReleasedAt":"2026-06-03T12:55:19.000Z","daysToFix":-20,"fixCheckedAt":"2026-10-29T21:33:52.687Z","capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/daytonaio/daytona","fixedVersion":"0.184.0","matchedVersion":"v0.184.0","fixReleasedAt":"2026-06-03T12:55:19.000Z","daysToFix":-20,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:33:52.540Z"}]}}