HighVulnerability
CVE-2026-54322: Daytona role update and delete endpoints allow cross-organization changes
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-54322
- Published
- Record updated
- Affected
- github.com/daytonaio/daytona <= 0.184.0
- Fixed in
- 0.185.0
- released June 9, 2026, 14 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
Prior to 0.185.0, Daytona's organization role update and delete endpoints checked that the caller owned the organization in the request path, but located the target role by identifier alone. An authenticated user who owns any organization could modify or delete a role belonging to a different organization if they knew that role's identifier. The flaw is tracked as CVE-2026-54322.
Mitigation
Fixed in 0.185.0.
Topics
Related items
- HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
- HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
- MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
- MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
- MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News