CVE-2026-54323: Daytona Information Disclosure Flaw

CVE-2026-54323 Overview

CVE-2026-54323 is a certificate validation vulnerability [CWE-295] in Daytona, a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Versions prior to 0.185.0 disabled TLS certificate verification in the daemon's git clone implementation. When a clone request carried Git credentials, the daemon transmitted the HTTP Basic Authorization header over an unvalidated TLS connection. The flaw affects both the go-git and native git CLI code paths. An attacker positioned to intercept clone traffic can capture credentials and serve tampered repository content into the sandbox.

Critical Impact
A network-positioned attacker can intercept Daytona clone traffic, harvest Git credentials, and inject malicious repository content into AI code execution sandboxes.

Affected Products

Daytona versions prior to 0.185.0
Daytona daemon go-git clone code path
Daytona daemon native git CLI clone code path

Discovery Timeline

2026-06-23 - CVE-2026-54323 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-54323

Vulnerability Analysis

The Daytona daemon performs git clone operations on behalf of sandboxes that run AI-generated code. Prior to version 0.185.0, the daemon's clone implementation explicitly disabled TLS certificate verification on outbound HTTPS connections. This applied to both clone backends: the go-git library and shell-outs to the native git CLI. When a developer or workflow supplied Git credentials with the clone request, the daemon attached them as an HTTP Basic Authorization header. Because the underlying TLS session never validated the server certificate, any party able to intercept the traffic could present an arbitrary certificate and complete the handshake.

The attacker outcome is twofold. First, the Basic auth header is delivered to the attacker, exposing the Git credentials in cleartext after TLS termination. Second, the attacker controls the repository content returned to the sandbox, allowing supply-chain tampering of code that subsequent AI workflows will execute.

Root Cause

The defect is an improper certificate validation flaw [CWE-295]. The clone code paths configured the HTTP transport to skip verification of the remote server's TLS certificate chain. This removed the only cryptographic binding between the hostname requested and the endpoint actually answering.

Attack Vector

Exploitation requires a network position that can intercept clone traffic between the Daytona daemon and the Git remote. This includes attackers on the same network segment, malicious upstream infrastructure, hostile Wi-Fi, or compromised DNS or BGP paths. User interaction is required: a clone request carrying credentials must be initiated. Once intercepted, the attacker presents any TLS certificate, terminates the session, records the Authorization header, and proxies or substitutes the repository response.

No verified proof-of-concept code is publicly available. Refer to the GitHub Security Advisory GHSA-375h-72g4-hc9c for vendor technical details.

Detection Methods for CVE-2026-54323

Indicators of Compromise

Unexpected TLS certificate fingerprints presented to Daytona daemon hosts when contacting Git remotes such as github.com, gitlab.com, or self-hosted endpoints.
Daytona sandbox executions referencing repository content or commits that do not exist in the legitimate upstream repository.
Authentication anomalies on Git providers, including logins or token usage from IP addresses associated with Daytona network egress but at unexpected times.

Detection Strategies

Inspect TLS certificate metadata for outbound connections from Daytona daemon hosts and alert on issuers or fingerprints that do not match expected Git provider chains.
Audit Daytona daemon versions across the fleet and flag any instance running a release earlier than 0.185.0.
Compare cloned repository commit hashes inside sandboxes against upstream provider APIs to detect tampering.

Monitoring Recommendations

Forward Daytona daemon logs, host network telemetry, and Git provider audit logs into a centralized analytics pipeline for correlation.
Monitor for Git credential reuse from unfamiliar IP ranges following sandbox clone activity.
Track outbound TCP/443 destinations from Daytona hosts and alert on connections to non-allowlisted Git endpoints.

How to Mitigate CVE-2026-54323

Immediate Actions Required

Upgrade all Daytona installations to version 0.185.0 or later.
Rotate any Git credentials, personal access tokens, and deploy keys that were configured in Daytona clone requests on vulnerable versions.
Review sandbox execution history for repositories cloned during the exposure window and validate that the code matches upstream.

Patch Information

The vulnerability is fixed in Daytona 0.185.0. The patch re-enables TLS certificate verification on both the go-git and native git CLI clone paths. See the Daytona Security Advisory GHSA-375h-72g4-hc9c for the official fix details.

Workarounds

Restrict the Daytona daemon's egress to a trusted, authenticated proxy that enforces TLS validation on its behalf until patching is complete.
Avoid supplying Git credentials to clone requests on unpatched daemons; use unauthenticated clones of public repositories where feasible.
Pin Git remotes to private network paths protected by mutual TLS or VPN to reduce interception opportunities.

bash

# Upgrade Daytona to the fixed release
daytona version
# If output is below 0.185.0, upgrade per vendor instructions, then verify:
daytona version    # expect >= 0.185.0