CVE-2026-54324

6.5 Moyenne

Publiée le 23/06/2026 à 20:18 · Modifiée le 25/06/2026 à 15:16 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, a cross-tenant authorization flaw in Daytona's notification WebSocket gateway allowed any authenticated user to subscribe to another organization's realtime notification channel and passively receive that organization's events. This vulnerability is fixed in 0.185.0.

Traduire en français

Produits concernés

daytonaio daytona

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-639
CWE-863

Références

https://github.com/daytonaio/daytona/security/advisories/GHSA-qwxf-2m7m-2m3x

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories