Read the docs
TI-2026-39215 Aliases CVE-2026-54320

Daytona: Cross-tenant organization takeover via invitation acceptance with an unverified email

Priority LOW 38CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.184.0, organization invitations could be accepted (and declined) by a user whose email matched the invitation but had not been verified. Daytona authenticates users via OIDC and matches an invitation's target email against the email in the caller's token, but the invitation accept and decline paths did not require that email to be verified, unlike organization creation, which already enforced verification. On identity providers that allow self-service signup and issue a session before the email is verified, an actor could register an address matching a pending invitation, leave it unverified, and accept the invitation, joining the target organization with the role the invitation carried (up to Owner). This vulnerability is fixed in 0.184.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00352 29th percentileScored 2026-11-07
Fix Fixed daytona (daytonaio): 0.184.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
daytonaiodaytonabefore 0.184.00.184.0Patch availableCNA
  • daytona Vendordaytonaio Affected before 0.184.0 Fixed in 0.184.0 Patch available CNA

Remediation

  • Fix · CNA daytona (daytonaio) Fixed in 0.184.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54320

References

Other 1

  • TI-2026-39217 Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles CVSS 3.1HIGH 7.7
  • TI-2026-39216 Daytona: Public sandbox previews remain accessible for up to one hour after being made private CVSS 3.1HIGH 7.0
  • TI-2026-39219 Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join CVSS 3.1MEDIUM 6.5
  • TI-2026-39218 Daytona: Git credential leak via git clone with TLS verification disabled CVSS 3.1MEDIUM 5.9
  • TI-2026-39214 Path traversal in daytonaio daytona CVSS 3.1MEDIUM 4.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences