CVE-2026-54323: Daytona git clone skips TLS certificate verification, exposing credentials

Summary

Daytona, an infrastructure runtime for AI-generated code execution and agent workflows, prior to 0.185.0 disabled TLS certificate verification in the daemon's git clone implementation on both the go-git and native git CLI code paths. When a clone request carried Git credentials, the daemon sent the HTTP Basic Authorization header over an unvalidated connection. An attacker able to intercept clone traffic could present any TLS certificate, capture those credentials, and serve tampered repository content into the sandbox.

Mitigation

Fixed in 0.185.0.

Topics

• Coding assistants

Related items

• MediumAI broke the cybersecurity world. What’s next?Similar attack · The Verge (AI)
• InfoGem5-Shark: Smaug-based Heterogeneous Deep Learning Accelerator Security and Robustness Evaluation and Characterization FrameworkSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoCVE-2026-123357: GROBID command execution through crafted PDF filename in Linux conversionSimilar attack · NVD/CVE Database
• MediumShai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI ToolsSimilar attack · Socket Blog
• MediumCPython flaw exposes AI inference servers to sandbox escape attacksSimilar attack · CSO Online