HighVulnerability
CVE-2026-54321: Daytona sandbox previews reachable without authentication when private
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-54321
- Published
- Record updated
- Affected
- github.com/daytonaio/daytona >= 0.101.0, <= 0.183.0
- Fixed in
- 0.184.0
- released June 3, 2026, 20 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
CVE-2026-54321 affects Daytona from 0.101.0 until 0.184.0. Sandbox previews switched from public to private could stay reachable without authentication for a short period, because a cached visibility state was not invalidated when the sandbox's visibility changed. The weakness is classified as CWE-613 (Insufficient Session Expiration) and CWE-863 (Incorrect Authorization).
Mitigation
This vulnerability is fixed in 0.184.0.
Topics
Related items
- MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
- MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News
- HighCVE-2026-97677: IBM Langflow OSS arbitrary file write and read by authenticated flow authorsSimilar attack · NVD/CVE Database
- MediumRecent AI agent experiments reveal a risky future of machine 'teamwork' inside corporationsSimilar attack · CNBC Technology
- MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News