TI-2026-39215 CVE-2026-54320
Daytona: Cross-tenant organization takeover via invitation acceptance with an unverified email
Priority LOW 38
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows.
daytonaio
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
daytonaio records in CISA KEVNo daytonaio vulnerabilities are listed in CISA KEV.
Records
6 records
TI-2026-39217 CVE-2026-54322 · GHSA-qxvm-pcfm-qc39
Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles
Priority LOW 33
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows.
TI-2026-39216 CVE-2026-54321 · GHSA-ww63-pv5x-vfc8
Daytona: Public sandbox previews remain accessible for up to one hour after being made private
Priority LOW 31
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows.
TI-2026-39219 CVE-2026-54324 · GHSA-qwxf-2m7m-2m3x
Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join
Priority LOW 29
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows.
TI-2026-39218 CVE-2026-54323
Daytona: Git credential leak via git clone with TLS verification disabled
Priority LOW 26
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows.
TI-2026-39214 CVE-2026-54319 · GHSA-fjv8-j4p5-cr9m
Path traversal in daytonaio daytona
Priority LOW 19
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows.