CVE-2026-54321

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54321
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54321.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54321
Aliases
Downstream
Related
Published
2026-06-23T18:10:05Z
Modified
2026-08-12T03:51:47Z
Severity
  • 7.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L CVSS Calculator
Summary
Daytona: Public sandbox previews remain accessible for up to one hour after being made private
Details

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. From 0.101.0 until 0.184.0, sandbox previews that were switched from public to private could remain reachable without authentication for a short period after the change, due to a cached visibility state that was not invalidated when the sandbox's visibility changed. This vulnerability is fixed in 0.184.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-613",
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54321.json"
}
References

Affected packages

Git / github.com/daytonaio/daytona

Affected ranges

Type
GIT
Repo
https://github.com/daytonaio/daytona
Events
Introduced
77c7ade9f32c374d7fc70281599a9e71c2b364da
Fixed
01ced9c219a527a6736ae47b8ea5b251c81c23db
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.101.0"
        },
        {
            "fixed": "0.184.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

libs/api-client-go/v0.*
libs/api-client-go/v0.137.0
libs/api-client-go/v0.138.0
libs/api-client-go/v0.139.0
libs/api-client-go/v0.140.0
libs/api-client-go/v0.141.0
libs/api-client-go/v0.142.0
libs/api-client-go/v0.143.0
libs/api-client-go/v0.144.0
libs/api-client-go/v0.144.1
libs/api-client-go/v0.145.0
libs/api-client-go/v0.146.0
libs/api-client-go/v0.147.0
libs/api-client-go/v0.148.0
libs/api-client-go/v0.149.0
libs/api-client-go/v0.150.0
libs/api-client-go/v0.151.0
libs/api-client-go/v0.152.0
libs/api-client-go/v0.152.1
libs/api-client-go/v0.153.0
libs/api-client-go/v0.154.0
libs/api-client-go/v0.155.0
libs/api-client-go/v0.156.0
libs/api-client-go/v0.157.0
libs/api-client-go/v0.158.0
libs/api-client-go/v0.158.1
libs/api-client-go/v0.159.0
libs/api-client-go/v0.160.0
libs/api-client-go/v0.161.0
libs/api-client-go/v0.162.0
libs/api-client-go/v0.163.0
libs/api-client-go/v0.164.0
libs/api-client-go/v0.165.0
libs/api-client-go/v0.166.0
libs/api-client-go/v0.167.0
libs/api-client-go/v0.168.0
libs/api-client-go/v0.169.0
libs/api-client-go/v0.170.0
libs/api-client-go/v0.171.0
libs/api-client-go/v0.172.0
libs/api-client-go/v0.173.0
libs/api-client-go/v0.174.0
libs/api-client-go/v0.175.0
libs/api-client-go/v0.176.0
libs/api-client-go/v0.177.0
libs/api-client-go/v0.178.0
libs/api-client-go/v0.179.0
libs/api-client-go/v0.180.0
libs/api-client-go/v0.181.0
libs/api-client-go/v0.182.0
libs/api-client-go/v0.183.0
libs/sdk-go/v0.*
libs/sdk-go/v0.137.0
libs/sdk-go/v0.138.0
libs/sdk-go/v0.139.0
libs/sdk-go/v0.140.0
libs/sdk-go/v0.141.0
libs/sdk-go/v0.142.0
libs/sdk-go/v0.143.0
libs/sdk-go/v0.144.0
libs/sdk-go/v0.144.1
libs/sdk-go/v0.145.0
libs/sdk-go/v0.146.0
libs/sdk-go/v0.147.0
libs/sdk-go/v0.148.0
libs/sdk-go/v0.149.0
libs/sdk-go/v0.150.0
libs/sdk-go/v0.151.0
libs/sdk-go/v0.152.0
libs/sdk-go/v0.152.1
libs/sdk-go/v0.153.0
libs/sdk-go/v0.154.0
libs/sdk-go/v0.155.0
libs/sdk-go/v0.156.0
libs/sdk-go/v0.157.0
libs/sdk-go/v0.158.0
libs/sdk-go/v0.158.1
libs/sdk-go/v0.159.0
libs/sdk-go/v0.160.0
libs/sdk-go/v0.161.0
libs/sdk-go/v0.162.0
libs/sdk-go/v0.163.0
libs/sdk-go/v0.164.0
libs/sdk-go/v0.165.0
libs/sdk-go/v0.166.0
libs/sdk-go/v0.167.0
libs/sdk-go/v0.168.0
libs/sdk-go/v0.169.0
libs/sdk-go/v0.170.0
libs/sdk-go/v0.171.0
libs/sdk-go/v0.172.0
libs/sdk-go/v0.173.0
libs/sdk-go/v0.174.0
libs/sdk-go/v0.175.0
libs/sdk-go/v0.176.0
libs/sdk-go/v0.177.0
libs/sdk-go/v0.178.0
libs/sdk-go/v0.179.0
libs/sdk-go/v0.180.0
libs/sdk-go/v0.181.0
libs/sdk-go/v0.182.0
libs/sdk-go/v0.183.0
libs/toolbox-api-client-go/v0.*
libs/toolbox-api-client-go/v0.137.0
libs/toolbox-api-client-go/v0.138.0
libs/toolbox-api-client-go/v0.139.0
libs/toolbox-api-client-go/v0.140.0
libs/toolbox-api-client-go/v0.141.0
libs/toolbox-api-client-go/v0.142.0
libs/toolbox-api-client-go/v0.143.0
libs/toolbox-api-client-go/v0.144.0
libs/toolbox-api-client-go/v0.144.1
libs/toolbox-api-client-go/v0.145.0
libs/toolbox-api-client-go/v0.146.0
libs/toolbox-api-client-go/v0.147.0
libs/toolbox-api-client-go/v0.148.0
libs/toolbox-api-client-go/v0.149.0
libs/toolbox-api-client-go/v0.150.0
libs/toolbox-api-client-go/v0.151.0
libs/toolbox-api-client-go/v0.152.0
libs/toolbox-api-client-go/v0.152.1
libs/toolbox-api-client-go/v0.153.0
libs/toolbox-api-client-go/v0.154.0
libs/toolbox-api-client-go/v0.155.0
libs/toolbox-api-client-go/v0.156.0
libs/toolbox-api-client-go/v0.157.0
libs/toolbox-api-client-go/v0.158.0
libs/toolbox-api-client-go/v0.158.1
libs/toolbox-api-client-go/v0.159.0
libs/toolbox-api-client-go/v0.160.0
libs/toolbox-api-client-go/v0.161.0
libs/toolbox-api-client-go/v0.162.0
libs/toolbox-api-client-go/v0.163.0
libs/toolbox-api-client-go/v0.164.0
libs/toolbox-api-client-go/v0.165.0
libs/toolbox-api-client-go/v0.166.0
libs/toolbox-api-client-go/v0.167.0
libs/toolbox-api-client-go/v0.168.0
libs/toolbox-api-client-go/v0.169.0
libs/toolbox-api-client-go/v0.170.0
libs/toolbox-api-client-go/v0.171.0
libs/toolbox-api-client-go/v0.172.0
libs/toolbox-api-client-go/v0.173.0
libs/toolbox-api-client-go/v0.174.0
libs/toolbox-api-client-go/v0.175.0
libs/toolbox-api-client-go/v0.176.0
libs/toolbox-api-client-go/v0.177.0
libs/toolbox-api-client-go/v0.178.0
libs/toolbox-api-client-go/v0.179.0
libs/toolbox-api-client-go/v0.180.0
libs/toolbox-api-client-go/v0.181.0
libs/toolbox-api-client-go/v0.182.0
libs/toolbox-api-client-go/v0.183.0
v0.*
v0.101.0
v0.102.0
v0.103.0
v0.104.0
v0.104.1
v0.105.0
v0.106.0
v0.106.1
v0.106.2
v0.106.3
v0.107.0
v0.107.1
v0.108.0
v0.108.1
v0.109.0
v0.110.0
v0.110.2
v0.111.0
v0.111.1
v0.112.0
v0.112.1
v0.112.2
v0.112.3
v0.113.0
v0.113.1
v0.114.0
v0.115.0
v0.115.1
v0.115.2
v0.116.0
v0.117.0
v0.118.0
v0.119.0
v0.120.0
v0.120.1
v0.121.0
v0.122.0
v0.123.0
v0.124.0
v0.124.1
v0.125.0
v0.126.0
v0.127.0
v0.128.0
v0.128.1
v0.129.0
v0.130.0
v0.131.0
v0.132.0
v0.133.0
v0.134.0
v0.135.0
v0.136.0
v0.137.0
v0.137.1
v0.138.0
v0.139.0
v0.140.0
v0.141.0
v0.142.0
v0.143.0
v0.144.0
v0.144.1
v0.145.0
v0.146.0
v0.147.0
v0.148.0
v0.149.0
v0.150.0
v0.151.0
v0.152.0
v0.152.1
v0.153.0
v0.154.0
v0.155.0
v0.156.0
v0.157.0
v0.158.0
v0.158.1
v0.159.0
v0.160.0
v0.161.0
v0.162.0
v0.163.0
v0.164.0
v0.165.0
v0.166.0
v0.167.0
v0.168.0
v0.169.0
v0.170.0
v0.171.0
v0.172.0
v0.173.0
v0.174.0
v0.175.0
v0.176.0
v0.177.0
v0.178.0
v0.179.0
v0.180.0
v0.181.0
v0.182.0
v0.183.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54321.json"