CVE-2026-54324

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54324
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54324.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54324
Aliases
Downstream
Related
Published
2026-06-23T18:07:23Z
Modified
2026-08-12T03:51:34Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join
Details

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, a cross-tenant authorization flaw in Daytona's notification WebSocket gateway allowed any authenticated user to subscribe to another organization's realtime notification channel and passively receive that organization's events. This vulnerability is fixed in 0.185.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-639",
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54324.json"
}
References

Affected packages

Git / github.com/daytonaio/daytona

Affected ranges

Type
GIT
Repo
https://github.com/daytonaio/daytona
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
39f970a8f5d7e1110fad672cfa49200f725beb83
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.185.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

libs/api-client-go/v0.*
libs/api-client-go/v0.137.0
libs/api-client-go/v0.138.0
libs/api-client-go/v0.139.0
libs/api-client-go/v0.140.0
libs/api-client-go/v0.141.0
libs/api-client-go/v0.142.0
libs/api-client-go/v0.143.0
libs/api-client-go/v0.144.0
libs/api-client-go/v0.144.1
libs/api-client-go/v0.145.0
libs/api-client-go/v0.146.0
libs/api-client-go/v0.147.0
libs/api-client-go/v0.148.0
libs/api-client-go/v0.149.0
libs/api-client-go/v0.150.0
libs/api-client-go/v0.151.0
libs/api-client-go/v0.152.0
libs/api-client-go/v0.152.1
libs/api-client-go/v0.153.0
libs/api-client-go/v0.154.0
libs/api-client-go/v0.155.0
libs/api-client-go/v0.156.0
libs/api-client-go/v0.157.0
libs/api-client-go/v0.158.0
libs/api-client-go/v0.158.1
libs/api-client-go/v0.159.0
libs/api-client-go/v0.160.0
libs/api-client-go/v0.161.0
libs/api-client-go/v0.162.0
libs/api-client-go/v0.163.0
libs/api-client-go/v0.164.0
libs/api-client-go/v0.165.0
libs/api-client-go/v0.166.0
libs/api-client-go/v0.167.0
libs/api-client-go/v0.168.0
libs/api-client-go/v0.169.0
libs/api-client-go/v0.170.0
libs/api-client-go/v0.171.0
libs/api-client-go/v0.172.0
libs/api-client-go/v0.173.0
libs/api-client-go/v0.174.0
libs/api-client-go/v0.175.0
libs/api-client-go/v0.176.0
libs/api-client-go/v0.177.0
libs/api-client-go/v0.178.0
libs/api-client-go/v0.179.0
libs/api-client-go/v0.180.0
libs/api-client-go/v0.181.0
libs/api-client-go/v0.182.0
libs/api-client-go/v0.183.0
libs/api-client-go/v0.184.0
libs/sdk-go/v0.*
libs/sdk-go/v0.137.0
libs/sdk-go/v0.138.0
libs/sdk-go/v0.139.0
libs/sdk-go/v0.140.0
libs/sdk-go/v0.141.0
libs/sdk-go/v0.142.0
libs/sdk-go/v0.143.0
libs/sdk-go/v0.144.0
libs/sdk-go/v0.144.1
libs/sdk-go/v0.145.0
libs/sdk-go/v0.146.0
libs/sdk-go/v0.147.0
libs/sdk-go/v0.148.0
libs/sdk-go/v0.149.0
libs/sdk-go/v0.150.0
libs/sdk-go/v0.151.0
libs/sdk-go/v0.152.0
libs/sdk-go/v0.152.1
libs/sdk-go/v0.153.0
libs/sdk-go/v0.154.0
libs/sdk-go/v0.155.0
libs/sdk-go/v0.156.0
libs/sdk-go/v0.157.0
libs/sdk-go/v0.158.0
libs/sdk-go/v0.158.1
libs/sdk-go/v0.159.0
libs/sdk-go/v0.160.0
libs/sdk-go/v0.161.0
libs/sdk-go/v0.162.0
libs/sdk-go/v0.163.0
libs/sdk-go/v0.164.0
libs/sdk-go/v0.165.0
libs/sdk-go/v0.166.0
libs/sdk-go/v0.167.0
libs/sdk-go/v0.168.0
libs/sdk-go/v0.169.0
libs/sdk-go/v0.170.0
libs/sdk-go/v0.171.0
libs/sdk-go/v0.172.0
libs/sdk-go/v0.173.0
libs/sdk-go/v0.174.0
libs/sdk-go/v0.175.0
libs/sdk-go/v0.176.0
libs/sdk-go/v0.177.0
libs/sdk-go/v0.178.0
libs/sdk-go/v0.179.0
libs/sdk-go/v0.180.0
libs/sdk-go/v0.181.0
libs/sdk-go/v0.182.0
libs/sdk-go/v0.183.0
libs/sdk-go/v0.184.0
libs/toolbox-api-client-go/v0.*
libs/toolbox-api-client-go/v0.137.0
libs/toolbox-api-client-go/v0.138.0
libs/toolbox-api-client-go/v0.139.0
libs/toolbox-api-client-go/v0.140.0
libs/toolbox-api-client-go/v0.141.0
libs/toolbox-api-client-go/v0.142.0
libs/toolbox-api-client-go/v0.143.0
libs/toolbox-api-client-go/v0.144.0
libs/toolbox-api-client-go/v0.144.1
libs/toolbox-api-client-go/v0.145.0
libs/toolbox-api-client-go/v0.146.0
libs/toolbox-api-client-go/v0.147.0
libs/toolbox-api-client-go/v0.148.0
libs/toolbox-api-client-go/v0.149.0
libs/toolbox-api-client-go/v0.150.0
libs/toolbox-api-client-go/v0.151.0
libs/toolbox-api-client-go/v0.152.0
libs/toolbox-api-client-go/v0.152.1
libs/toolbox-api-client-go/v0.153.0
libs/toolbox-api-client-go/v0.154.0
libs/toolbox-api-client-go/v0.155.0
libs/toolbox-api-client-go/v0.156.0
libs/toolbox-api-client-go/v0.157.0
libs/toolbox-api-client-go/v0.158.0
libs/toolbox-api-client-go/v0.158.1
libs/toolbox-api-client-go/v0.159.0
libs/toolbox-api-client-go/v0.160.0
libs/toolbox-api-client-go/v0.161.0
libs/toolbox-api-client-go/v0.162.0
libs/toolbox-api-client-go/v0.163.0
libs/toolbox-api-client-go/v0.164.0
libs/toolbox-api-client-go/v0.165.0
libs/toolbox-api-client-go/v0.166.0
libs/toolbox-api-client-go/v0.167.0
libs/toolbox-api-client-go/v0.168.0
libs/toolbox-api-client-go/v0.169.0
libs/toolbox-api-client-go/v0.170.0
libs/toolbox-api-client-go/v0.171.0
libs/toolbox-api-client-go/v0.172.0
libs/toolbox-api-client-go/v0.173.0
libs/toolbox-api-client-go/v0.174.0
libs/toolbox-api-client-go/v0.175.0
libs/toolbox-api-client-go/v0.176.0
libs/toolbox-api-client-go/v0.177.0
libs/toolbox-api-client-go/v0.178.0
libs/toolbox-api-client-go/v0.179.0
libs/toolbox-api-client-go/v0.180.0
libs/toolbox-api-client-go/v0.181.0
libs/toolbox-api-client-go/v0.182.0
libs/toolbox-api-client-go/v0.183.0
libs/toolbox-api-client-go/v0.184.0
v0.*
v0.1.0
v0.10.0
v0.100.0
v0.101.0
v0.102.0
v0.103.0
v0.104.0
v0.104.1
v0.105.0
v0.106.0
v0.106.1
v0.106.2
v0.106.3
v0.107.0
v0.107.1
v0.108.0
v0.108.1
v0.109.0
v0.11.0
v0.110.0
v0.110.2
v0.111.0
v0.111.1
v0.112.0
v0.112.1
v0.112.2
v0.112.3
v0.113.0
v0.113.1
v0.114.0
v0.115.0
v0.115.1
v0.115.2
v0.116.0
v0.117.0
v0.118.0
v0.119.0
v0.12.0
v0.12.0-alpha
v0.12.1
v0.120.0
v0.120.1
v0.121.0
v0.122.0
v0.123.0
v0.124.0
v0.124.1
v0.125.0
v0.126.0
v0.127.0
v0.128.0
v0.128.1
v0.129.0
v0.13.0
v0.130.0
v0.131.0
v0.132.0
v0.133.0
v0.134.0
v0.135.0
v0.136.0
v0.137.0
v0.137.1
v0.138.0
v0.139.0
v0.14.0
v0.140.0
v0.141.0
v0.142.0
v0.143.0
v0.144.0
v0.144.1
v0.145.0
v0.146.0
v0.147.0
v0.148.0
v0.149.0
v0.15.0
v0.150.0
v0.151.0
v0.152.0
v0.152.1
v0.153.0
v0.154.0
v0.155.0
v0.156.0
v0.157.0
v0.158.0
v0.158.1
v0.159.0
v0.16.0
v0.160.0
v0.161.0
v0.162.0
v0.163.0
v0.164.0
v0.165.0
v0.166.0
v0.167.0
v0.168.0
v0.169.0
v0.17.0
v0.170.0
v0.171.0
v0.172.0
v0.173.0
v0.174.0
v0.175.0
v0.176.0
v0.177.0
v0.178.0
v0.179.0
v0.18.0
v0.180.0
v0.181.0
v0.182.0
v0.183.0
v0.184.0
v0.19.0
v0.19.1
v0.2.0
v0.20.0
v0.21.0
v0.21.1
v0.21.2
v0.21.3
v0.22.0
v0.22.1
v0.23.0
v0.23.1
v0.24.0
v0.25.0
v0.25.1
v0.25.2
v0.26.0
v0.26.1
v0.27.0
v0.28.0
v0.28.1
v0.29.0
v0.29.1
v0.3.0
v0.3.1
v0.30.0
v0.30.1
v0.31.0
v0.31.0-beta.1
v0.32.0
v0.33.0
v0.34.0
v0.35.0
v0.35.1
v0.36.0
v0.37.0
v0.38.0
v0.39.0
v0.4.0
v0.4.1
v0.40.0
v0.41.0
v0.42.0
v0.42.1
v0.43.0
v0.44.0
v0.44.1
v0.45.0
v0.46.0
v0.46.1
v0.47.0
v0.48.0
v0.49.0
v0.5.0
v0.50.0
v0.51.0
v0.52.0
v0.52.1
v0.53.0
v0.6.0
v0.7.0
v0.7.1
v0.8.0
v0.8.1
v0.8.2
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54324.json"