Vulnerability in Daytonaio Daytona
CVE-2026-54323
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, the daemon's git clone implementation disabled TLS certificate verification. When a clone request carried Git credentials, the daemon sent the HTTP Basic Authorization header to the remote over a connection whose certificate was never validated, on both the go-git and native git CLI code paths. An attacker able to intercept clone traffic could present any TLS certificate, capture the Git credentials supplied for the clone, and serve tampered repository content into the sandbox. This vulnerability is fixed in 0.185.0.
Vulnerability class: Improper Certificate Validation
EPSS: 0.002 (8.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N.
Affected products
- Daytonaio Daytona — versions < 0.185.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2026-54323?
- CVE-2026-54323 is a medium-severity vulnerability in Daytonaio Daytona, classified under Improper Certificate Validation. CVSS score: 5.9/10. Published 2026-06-23.
- How severe is CVE-2026-54323?
- Medium severity. CVSS v3 base score is 5.9 out of 10.