CVE-2026-54324 Overview
CVE-2026-54324 is a cross-tenant authorization flaw in Daytona, a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. The vulnerability resides in Daytona's notification WebSocket gateway. Any authenticated user can subscribe to another organization's realtime notification channel and passively receive that organization's events. This breaks tenant isolation and exposes sensitive operational data across organizational boundaries. The flaw is classified under [CWE-639] (Authorization Bypass Through User-Controlled Key). Versions prior to 0.185.0 are affected, and the issue is fixed in 0.185.0.
Critical Impact
Authenticated attackers can passively eavesdrop on another organization's realtime notification events, breaking multi-tenant isolation and exposing sensitive workflow data.
Affected Products
- Daytona versions prior to 0.185.0
- Daytona notification WebSocket gateway component
- Multi-tenant Daytona deployments hosting AI-generated code execution and agent workflows
Discovery Timeline
- 2026-06-23 - CVE-2026-54324 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-54324
Vulnerability Analysis
The vulnerability stems from improper authorization enforcement in Daytona's WebSocket notification gateway. When an authenticated client opens a WebSocket connection and subscribes to a notification channel, the gateway does not verify that the requesting user's organization matches the organization identifier embedded in the channel subscription request. As a result, any valid authenticated session can target an arbitrary organization channel and begin receiving events streamed to that channel. The exposure is passive but continuous, meaning an attacker can silently observe events until the connection is closed. Because Daytona orchestrates AI-generated code execution and agent workflows, the leaked notifications can include workflow state, job lifecycle events, and other tenant-specific operational metadata.
Root Cause
The root cause is missing tenant-scoped authorization on the subscription handler of the notification WebSocket gateway. Authentication is verified, but authorization to a specific organization's channel relies on a user-controlled identifier without server-side validation. This pattern matches [CWE-639], Authorization Bypass Through User-Controlled Key.
Attack Vector
Exploitation requires an authenticated account on the target Daytona instance and network reachability to the WebSocket endpoint. The attacker establishes a WebSocket session, then issues a subscribe message referencing a victim organization's channel identifier. The gateway accepts the subscription and begins forwarding the victim organization's notification events. No user interaction from the victim is required, and the attack leaves limited application-layer evidence beyond connection logs. Refer to the GitHub Security Advisory for the maintainer's technical description.
Detection Methods for CVE-2026-54324
Indicators of Compromise
- WebSocket subscription requests where the authenticated user's organization identifier does not match the subscribed channel's organization identifier.
- Long-lived WebSocket sessions from accounts that historically had little or no notification gateway activity.
- Repeated subscription attempts enumerating multiple organization identifiers from a single authenticated session.
Detection Strategies
- Audit Daytona application logs for cross-organization channel subscription events on the notification gateway.
- Correlate authenticated user identity with subscribed channel ownership and alert on mismatches.
- Baseline normal WebSocket subscription patterns per user and flag anomalous fan-out to channels outside the user's tenancy.
Monitoring Recommendations
- Forward Daytona gateway and reverse proxy logs to a centralized analytics platform for cross-tenant subscription analysis.
- Monitor for sustained outbound WebSocket frames associated with accounts that do not own the subscribed channel.
- Track Daytona version inventory and alert when any node is running a release earlier than 0.185.0.
How to Mitigate CVE-2026-54324
Immediate Actions Required
- Upgrade all Daytona instances to version 0.185.0 or later, which contains the authorization fix.
- Review notification gateway logs for prior cross-tenant subscription activity and notify affected tenants if exposure is identified.
- Rotate any secrets or workflow identifiers that may have been disclosed through leaked notification events.
Patch Information
The vulnerability is fixed in Daytona 0.185.0. The patch adds server-side authorization checks that bind WebSocket channel subscriptions to the authenticated user's organization. See the GitHub Security Advisory GHSA-qwxf-2m7m-2m3x for the official maintainer guidance.
Workarounds
- If immediate upgrade is not possible, restrict access to the Daytona notification gateway to trusted networks using firewall or reverse proxy controls.
- Reduce the issuance of long-lived authentication tokens and shorten session lifetimes to limit exposure windows.
- Disable or proxy-filter the notification WebSocket endpoint until the upgrade to 0.185.0 is completed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
