CVE-2026-54319: Daytona Path Traversal Vulnerability

CVE-2026-54319 Overview

CVE-2026-54319 is a path traversal vulnerability [CWE-22] in Daytona, a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. In versions prior to 0.186, a sandbox volume reference (volumeId, which may also be a volume name) was forwarded to the runner and used to construct the host bind-mount source path without confinement. A reference containing path-traversal sequences could resolve the mount source outside the intended per-volume base directory. The issue is fixed in Daytona 0.186.

Critical Impact
Authenticated users could leverage crafted volume references to bind-mount host paths outside the per-volume base directory, exposing data outside the sandbox scope.

Affected Products

Daytona versions prior to 0.186
Daytona sandbox runner component
Deployments using volume bind-mount functionality

Discovery Timeline

2026-06-23 - CVE-2026-54319 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-54319

Vulnerability Analysis

The vulnerability resides in Daytona's sandbox volume handling logic. When a sandbox is created or updated with a volume reference, the runner receives the volumeId value, which can also represent a volume name. The runner then uses this value to build the host-side source path for a bind-mount into the sandbox container.

Because the reference was not confined to the per-volume base directory, supplying traversal sequences such as ../ segments could cause the constructed path to resolve outside the intended directory. The resulting bind-mount would expose unintended host content to the sandbox runtime.

The issue requires an authenticated actor able to submit volume references and is rated with limited confidentiality and integrity impact. No availability impact is associated with the flaw.

Root Cause

The root cause is missing path confinement when assembling the bind-mount source path. The runner concatenated the user-supplied volumeId with the per-volume base directory without canonicalizing the result or validating that the final path remained within the intended base. This is a textbook [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

An authenticated user with permission to create or attach sandbox volumes supplies a volumeId containing path-traversal sequences. The control-plane forwards this value to a runner, which constructs the host bind-mount source. The mount then references a directory outside the per-volume base, granting the sandbox visibility into host paths it should not access. Exploitation requires legitimate API access to volume operations.

The vulnerability is described in prose only; refer to the GitHub Security Advisory GHSA-fjv8-j4p5-cr9m for technical details.

Detection Methods for CVE-2026-54319

Indicators of Compromise

Volume references or volumeId values containing ../, ..\, encoded traversal sequences, or absolute paths in API requests to the Daytona control plane
Runner logs showing bind-mount source paths resolved outside the configured per-volume base directory
Sandbox processes accessing host files not associated with any provisioned volume

Detection Strategies

Audit Daytona API and runner logs for volume creation and attachment events with anomalous volumeId values
Compare runner-side resolved mount source paths against the canonical per-volume base directory and alert on mismatches
Inspect container mount tables on runner hosts for bind-mounts whose source paths fall outside expected volume directories

Monitoring Recommendations

Enable structured logging of all volume reference values submitted through the Daytona API
Forward Daytona control-plane and runner logs to a centralized analytics platform for correlation and retention
Alert on any volume operation where the post-resolution path does not begin with the configured base directory prefix

How to Mitigate CVE-2026-54319

Immediate Actions Required

Upgrade Daytona to version 0.186 or later on all control-plane and runner nodes
Review existing volumes for entries whose names or identifiers contain path-traversal sequences and remove them
Rotate credentials and tokens for any user account suspected of abusing the volume API prior to patching

Patch Information

The vulnerability is fixed in Daytona 0.186. Maintainers addressed the issue by confining the resolved bind-mount source path to the intended per-volume base directory. See the GitHub Security Advisory GHSA-fjv8-j4p5-cr9m for full remediation details.

Workarounds

Restrict access to volume creation and attachment APIs to trusted administrators until the upgrade is complete
Apply input validation at an API gateway or proxy to reject volumeId values containing .., /, \, or null bytes
Run Daytona runners with the least-privilege host filesystem layout, so sensitive directories are not present on the runner host

bash

# Configuration example: upgrade Daytona to the patched release
# Helm-based deployment
helm repo update
helm upgrade daytona daytona/daytona --version 0.186

# Verify the running version
kubectl exec -n daytona deploy/daytona-api -- daytona version