MediumVulnerability
CVE-2026-54324: Daytona cross-tenant authorization flaw in notification WebSocket gateway
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-54324
- Published
- Record updated
- Affected
- github.com/daytonaio/daytona <= 0.184.0
- Fixed in
- 0.185.0
- released June 9, 2026, 14 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.5%
Summary
CVE-2026-54324 affects Daytona, an infrastructure runtime for AI-generated code execution and agent workflows, prior to 0.185.0. A cross-tenant authorization flaw in its notification WebSocket gateway let any authenticated user subscribe to another organization's realtime notification channel and passively receive that organization's events.
Mitigation
Fixed in 0.185.0.