What is CVE-2026-54324?

CVE-2026-54324 is a medium-severity vulnerability in Daytonaio Daytona, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2026-06-23.

How severe is CVE-2026-54324?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Daytonaio Daytona

CVE-2026-54324

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, a cross-tenant authorization flaw in Daytona's notification WebSocket gateway allowed any authenticated user to subscribe to another organization's realtime notification channel and passively receive that organization's events. This vulnerability is fixed in 0.185.0.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.005 (38.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Daytonaio Daytona — versions < 0.185.0

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-54324?: CVE-2026-54324 is a medium-severity vulnerability in Daytonaio Daytona, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2026-06-23.
How severe is CVE-2026-54324?: Medium severity. CVSS v3 base score is 6.5 out of 10.