CVE-2026-54321: Daytona Auth Bypass Vulnerability

CVE-2026-54321 Overview

CVE-2026-54321 affects Daytona, a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Versions from 0.101.0 until 0.184.0 contain an insufficient session expiration flaw [CWE-613] in sandbox preview visibility handling. When a sandbox preview is switched from public to private, the cached visibility state is not invalidated. The preview remains reachable without authentication for a short period after the change. An unauthenticated network attacker can access sandbox contents that should be private. Daytona maintainers fixed the issue in version 0.184.0.

Critical Impact
Unauthenticated remote attackers can access sandbox previews recently transitioned from public to private, exposing AI-generated code and agent workflow data.

Affected Products

Daytona versions 0.101.0 through 0.183.x
Daytona sandbox preview service
Self-hosted and managed Daytona deployments running affected versions

Discovery Timeline

2026-06-23 - CVE-2026-54321 published to the National Vulnerability Database (NVD)
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54321

Vulnerability Analysis

The vulnerability resides in Daytona's sandbox preview visibility control. Daytona caches the visibility state of each sandbox preview to reduce backend lookups on every request. When an owner toggles a sandbox from public to private, the application updates the authoritative visibility record but does not invalidate the cached entry. Requests served from the cache continue to treat the sandbox as public until the cached value expires or is refreshed.

The weakness maps to [CWE-613] Insufficient Session Expiration. Although the visibility decision is not a session in the traditional authentication sense, the cached authorization state functions as one. Stale cached state grants access beyond the intended lifetime of the public setting.

Sandbox previews in Daytona often host AI-generated code, agent execution traces, and intermediate artifacts. Exposure of these resources can leak proprietary prompts, source code, secrets embedded in code, and runtime telemetry from agent workflows.

Root Cause

The root cause is missing cache invalidation on visibility state changes. The visibility cache entry persists after the underlying record transitions to private, producing a transient window in which authorization checks return a stale public verdict.

Attack Vector

Exploitation requires the attacker to know or guess the sandbox preview URL and to issue requests during the stale-cache window after a visibility change. No credentials, user interaction, or privileges are needed. The attack complexity is elevated because the attacker must time the request to the limited window during which the cache holds the outdated value. Consult the GitHub Security Advisory GHSA-ww63-pv5x-vfc8 for the maintainer's technical description.

Detection Methods for CVE-2026-54321

Indicators of Compromise

Access log entries for sandbox preview URLs from unauthenticated clients after a documented visibility change from public to private.
Requests to preview endpoints originating from IP addresses or user agents that were not observed during the public phase.
Repeated probing of preview hostnames or subdomains shortly after a visibility transition event in audit logs.

Detection Strategies

Correlate sandbox visibility change events with subsequent HTTP 200 responses to the same preview URL from unauthenticated sessions.
Alert on accesses to preview endpoints when the authoritative visibility record is private but the response status indicates content delivery.
Review reverse proxy or CDN cache hit ratios for preview endpoints to identify stale entries served after configuration changes.

Monitoring Recommendations

Enable verbose audit logging on visibility-change API calls and retain logs covering the cache TTL window.
Monitor for anomalous traffic spikes on preview hostnames within minutes of a visibility transition.
Forward Daytona application and proxy logs to a centralized analytics platform for cross-event correlation.

How to Mitigate CVE-2026-54321

Immediate Actions Required

Upgrade all Daytona installations to version 0.184.0 or later.
Audit sandbox previews that were transitioned from public to private while running affected versions and rotate any secrets exposed in those sandboxes.
Identify and review access logs for unauthorized preview access during the stale-cache window.

Patch Information

Daytona version 0.184.0 invalidates the cached visibility state when a sandbox transitions between public and private. Refer to the GitHub Security Advisory GHSA-ww63-pv5x-vfc8 for release details and remediation guidance.

Workarounds

Destroy and recreate sandboxes that must be private rather than toggling visibility on affected versions.
Restrict network access to Daytona preview endpoints behind an authenticated reverse proxy until the upgrade is applied.
Reduce or disable preview caching layers where configurable to shorten the stale-state window.

bash

# Configuration example
# Upgrade Daytona to the patched release
daytona version
yum update daytona  # or: apt-get install --only-upgrade daytona
# Verify the installed version is 0.184.0 or later
daytona version | grep -E "0\\.(18[4-9]|19[0-9]|[2-9][0-9]{2})"