CVE-2026-54324CWE-639CWE-863

Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join

Medium · published June 23, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
38.6
In the wild
Unconfirmed
What it is

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, a cross-tenant authorization flaw in Daytona's notification WebSocket gateway allowed any authenticated user to subscribe to another organization's realtime notification channel and passively receive that organization's events. This vulnerability is fixed in 0.185.0.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00456 · 38.6th percentile
Weaknesses
CWE-639 · Authorization Bypass Through User-Controlled Key; CWE-863 · Incorrect Authorization
Published
2026-06-23T18:07Z
EPSS history
Timeline
  • 23 JUN 18:07Z
    Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join
    cvelistv5