CVE-2026-54323

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54323
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54323.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54323
Aliases
  • GHSA-375h-72g4-hc9c
Published
2026-06-23T18:06:21.100Z
Modified
2026-07-15T01:49:11.252408614Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Daytona: Git credential leak via git clone with TLS verification disabled
Details

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, the daemon's git clone implementation disabled TLS certificate verification. When a clone request carried Git credentials, the daemon sent the HTTP Basic Authorization header to the remote over a connection whose certificate was never validated, on both the go-git and native git CLI code paths. An attacker able to intercept clone traffic could present any TLS certificate, capture the Git credentials supplied for the clone, and serve tampered repository content into the sandbox. This vulnerability is fixed in 0.185.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54323.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-295"
    ]
}
References

Affected packages

Git / github.com/daytonaio/daytona

Affected ranges

Type
GIT
Repo
https://github.com/daytonaio/daytona
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
39f970a8f5d7e1110fad672cfa49200f725beb83
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.185.0"
        }
    ]
}

Affected versions

libs/api-client-go/v0.*
libs/api-client-go/v0.137.0
libs/api-client-go/v0.138.0
libs/api-client-go/v0.139.0
libs/api-client-go/v0.140.0
libs/api-client-go/v0.141.0
libs/api-client-go/v0.142.0
libs/api-client-go/v0.143.0
libs/api-client-go/v0.144.0
libs/api-client-go/v0.144.1
libs/api-client-go/v0.145.0
libs/api-client-go/v0.146.0
libs/api-client-go/v0.147.0
libs/api-client-go/v0.148.0
libs/api-client-go/v0.149.0
libs/api-client-go/v0.150.0
libs/api-client-go/v0.151.0
libs/api-client-go/v0.152.0
libs/api-client-go/v0.152.1
libs/api-client-go/v0.153.0
libs/api-client-go/v0.154.0
libs/api-client-go/v0.155.0
libs/api-client-go/v0.156.0
libs/api-client-go/v0.157.0
libs/api-client-go/v0.158.0
libs/api-client-go/v0.158.1
libs/api-client-go/v0.159.0
libs/api-client-go/v0.160.0
libs/api-client-go/v0.161.0
libs/api-client-go/v0.162.0
libs/api-client-go/v0.163.0
libs/api-client-go/v0.164.0
libs/api-client-go/v0.165.0
libs/api-client-go/v0.166.0
libs/api-client-go/v0.167.0
libs/api-client-go/v0.168.0
libs/api-client-go/v0.169.0
libs/api-client-go/v0.170.0
libs/api-client-go/v0.171.0
libs/api-client-go/v0.172.0
libs/api-client-go/v0.173.0
libs/api-client-go/v0.174.0
libs/api-client-go/v0.175.0
libs/api-client-go/v0.176.0
libs/api-client-go/v0.177.0
libs/api-client-go/v0.178.0
libs/api-client-go/v0.179.0
libs/api-client-go/v0.180.0
libs/api-client-go/v0.181.0
libs/api-client-go/v0.182.0
libs/api-client-go/v0.183.0
libs/api-client-go/v0.184.0
libs/sdk-go/v0.*
libs/sdk-go/v0.137.0
libs/sdk-go/v0.138.0
libs/sdk-go/v0.139.0
libs/sdk-go/v0.140.0
libs/sdk-go/v0.141.0
libs/sdk-go/v0.142.0
libs/sdk-go/v0.143.0
libs/sdk-go/v0.144.0
libs/sdk-go/v0.144.1
libs/sdk-go/v0.145.0
libs/sdk-go/v0.146.0
libs/sdk-go/v0.147.0
libs/sdk-go/v0.148.0
libs/sdk-go/v0.149.0
libs/sdk-go/v0.150.0
libs/sdk-go/v0.151.0
libs/sdk-go/v0.152.0
libs/sdk-go/v0.152.1
libs/sdk-go/v0.153.0
libs/sdk-go/v0.154.0
libs/sdk-go/v0.155.0
libs/sdk-go/v0.156.0
libs/sdk-go/v0.157.0
libs/sdk-go/v0.158.0
libs/sdk-go/v0.158.1
libs/sdk-go/v0.159.0
libs/sdk-go/v0.160.0
libs/sdk-go/v0.161.0
libs/sdk-go/v0.162.0
libs/sdk-go/v0.163.0
libs/sdk-go/v0.164.0
libs/sdk-go/v0.165.0
libs/sdk-go/v0.166.0
libs/sdk-go/v0.167.0
libs/sdk-go/v0.168.0
libs/sdk-go/v0.169.0
libs/sdk-go/v0.170.0
libs/sdk-go/v0.171.0
libs/sdk-go/v0.172.0
libs/sdk-go/v0.173.0
libs/sdk-go/v0.174.0
libs/sdk-go/v0.175.0
libs/sdk-go/v0.176.0
libs/sdk-go/v0.177.0
libs/sdk-go/v0.178.0
libs/sdk-go/v0.179.0
libs/sdk-go/v0.180.0
libs/sdk-go/v0.181.0
libs/sdk-go/v0.182.0
libs/sdk-go/v0.183.0
libs/sdk-go/v0.184.0
libs/toolbox-api-client-go/v0.*
libs/toolbox-api-client-go/v0.137.0
libs/toolbox-api-client-go/v0.138.0
libs/toolbox-api-client-go/v0.139.0
libs/toolbox-api-client-go/v0.140.0
libs/toolbox-api-client-go/v0.141.0
libs/toolbox-api-client-go/v0.142.0
libs/toolbox-api-client-go/v0.143.0
libs/toolbox-api-client-go/v0.144.0
libs/toolbox-api-client-go/v0.144.1
libs/toolbox-api-client-go/v0.145.0
libs/toolbox-api-client-go/v0.146.0
libs/toolbox-api-client-go/v0.147.0
libs/toolbox-api-client-go/v0.148.0
libs/toolbox-api-client-go/v0.149.0
libs/toolbox-api-client-go/v0.150.0
libs/toolbox-api-client-go/v0.151.0
libs/toolbox-api-client-go/v0.152.0
libs/toolbox-api-client-go/v0.152.1
libs/toolbox-api-client-go/v0.153.0
libs/toolbox-api-client-go/v0.154.0
libs/toolbox-api-client-go/v0.155.0
libs/toolbox-api-client-go/v0.156.0
libs/toolbox-api-client-go/v0.157.0
libs/toolbox-api-client-go/v0.158.0
libs/toolbox-api-client-go/v0.158.1
libs/toolbox-api-client-go/v0.159.0
libs/toolbox-api-client-go/v0.160.0
libs/toolbox-api-client-go/v0.161.0
libs/toolbox-api-client-go/v0.162.0
libs/toolbox-api-client-go/v0.163.0
libs/toolbox-api-client-go/v0.164.0
libs/toolbox-api-client-go/v0.165.0
libs/toolbox-api-client-go/v0.166.0
libs/toolbox-api-client-go/v0.167.0
libs/toolbox-api-client-go/v0.168.0
libs/toolbox-api-client-go/v0.169.0
libs/toolbox-api-client-go/v0.170.0
libs/toolbox-api-client-go/v0.171.0
libs/toolbox-api-client-go/v0.172.0
libs/toolbox-api-client-go/v0.173.0
libs/toolbox-api-client-go/v0.174.0
libs/toolbox-api-client-go/v0.175.0
libs/toolbox-api-client-go/v0.176.0
libs/toolbox-api-client-go/v0.177.0
libs/toolbox-api-client-go/v0.178.0
libs/toolbox-api-client-go/v0.179.0
libs/toolbox-api-client-go/v0.180.0
libs/toolbox-api-client-go/v0.181.0
libs/toolbox-api-client-go/v0.182.0
libs/toolbox-api-client-go/v0.183.0
libs/toolbox-api-client-go/v0.184.0
v0.*
v0.1.0
v0.10.0
v0.100.0
v0.101.0
v0.102.0
v0.103.0
v0.104.0
v0.104.1
v0.105.0
v0.106.0
v0.106.1
v0.106.2
v0.106.3
v0.107.0
v0.107.1
v0.108.0
v0.108.1
v0.109.0
v0.11.0
v0.110.0
v0.110.2
v0.111.0
v0.111.1
v0.112.0
v0.112.1
v0.112.2
v0.112.3
v0.113.0
v0.113.1
v0.114.0
v0.115.0
v0.115.1
v0.115.2
v0.116.0
v0.117.0
v0.118.0
v0.119.0
v0.12.0
v0.12.0-alpha
v0.12.1
v0.120.0
v0.120.1
v0.121.0
v0.122.0
v0.123.0
v0.124.0
v0.124.1
v0.125.0
v0.126.0
v0.127.0
v0.128.0
v0.128.1
v0.129.0
v0.13.0
v0.130.0
v0.131.0
v0.132.0
v0.133.0
v0.134.0
v0.135.0
v0.136.0
v0.137.0
v0.137.1
v0.138.0
v0.139.0
v0.14.0
v0.140.0
v0.141.0
v0.142.0
v0.143.0
v0.144.0
v0.144.1
v0.145.0
v0.146.0
v0.147.0
v0.148.0
v0.149.0
v0.15.0
v0.150.0
v0.151.0
v0.152.0
v0.152.1
v0.153.0
v0.154.0
v0.155.0
v0.156.0
v0.157.0
v0.158.0
v0.158.1
v0.159.0
v0.16.0
v0.160.0
v0.161.0
v0.162.0
v0.163.0
v0.164.0
v0.165.0
v0.166.0
v0.167.0
v0.168.0
v0.169.0
v0.17.0
v0.170.0
v0.171.0
v0.172.0
v0.173.0
v0.174.0
v0.175.0
v0.176.0
v0.177.0
v0.178.0
v0.179.0
v0.18.0
v0.180.0
v0.181.0
v0.182.0
v0.183.0
v0.184.0
v0.19.0
v0.19.1
v0.2.0
v0.20.0
v0.21.0
v0.21.1
v0.21.2
v0.21.3
v0.22.0
v0.22.1
v0.23.0
v0.23.1
v0.24.0
v0.25.0
v0.25.1
v0.25.2
v0.26.0
v0.26.1
v0.27.0
v0.28.0
v0.28.1
v0.29.0
v0.29.1
v0.3.0
v0.3.1
v0.30.0
v0.30.1
v0.31.0
v0.31.0-beta.1
v0.32.0
v0.33.0
v0.34.0
v0.35.0
v0.35.1
v0.36.0
v0.37.0
v0.38.0
v0.39.0
v0.4.0
v0.4.1
v0.40.0
v0.41.0
v0.42.0
v0.42.1
v0.43.0
v0.44.0
v0.44.1
v0.45.0
v0.46.0
v0.46.1
v0.47.0
v0.48.0
v0.49.0
v0.5.0
v0.50.0
v0.51.0
v0.52.0
v0.52.1
v0.53.0
v0.6.0
v0.7.0
v0.7.1
v0.8.0
v0.8.1
v0.8.2
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54323.json"