{"id":"EUVD-2026-38565","enisaUuid":"03d7a5be-4787-3787-9ef3-bdf63ccc332f","description":"Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. From 0.101.0 until 0.184.0, sandbox previews that were switched from public to private could remain reachable without authentication for a short period after the change, due to a cached visibility state that was not invalidated when the sandbox\u0027s visibility changed. This vulnerability is fixed in 0.184.0.","datePublished":"Jun 23, 2026, 6:10:05 PM","dateUpdated":"Jun 25, 2026, 12:43:20 PM","baseScore":7.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","references":"https://github.com/daytonaio/daytona/security/advisories/GHSA-ww63-pv5x-vfc8\n","aliases":"CVE-2026-54321\nGHSA-ww63-pv5x-vfc8\n","assigner":"GitHub_M","epss":0.4,"enisaIdProduct":[{"id":"5fc4e6e8-df15-3b61-a944-ec144ec0d4e2","product":{"name":"daytona","vendor":{"name":"daytonaio"}},"product_version":"0.101.0, \u003c 0.184.0"}],"enisaIdVendor":[{"id":"9f3dd76d-3128-37b5-8eaf-5dd32e5f4d15","vendor":{"name":"daytonaio"}}],"enisaIdVulnerability":[{"id":"d84575e9-98e5-3e09-bff0-31d3f13e0f2e","vulnerability":{"id":"GHSA-ww63-pv5x-vfc8","description":"Daytona: Public sandbox previews remain accessible for up to one hour after being made private","datePublished":"Jun 16, 2026, 9:05:13 PM","dateUpdated":"Jul 20, 2026, 9:14:49 PM","baseScore":0.0,"references":"https://github.com/daytonaio/daytona/security/advisories/GHSA-ww63-pv5x-vfc8\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54321\nhttps://github.com/daytonaio/daytona\n","enisa_id":"EUVD-2026-38565\n","aliases":"GHSA-ww63-pv5x-vfc8\nCVE-2026-54321\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f139fcfb-2adb-32f9-86b1-546077ce5269","vulnerability":{"id":"CVE-2026-54321","description":"Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. From 0.101.0 until 0.184.0, sandbox previews that were switched from public to private could remain reachable without authentication for a short period after the change, due to a cached visibility state that was not invalidated when the sandbox\u0027s visibility changed. This vulnerability is fixed in 0.184.0.","datePublished":"Jun 23, 2026, 6:10:05 PM","dateUpdated":"Jun 25, 2026, 12:43:20 PM","status":"PUBLISHED","baseScore":7.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","references":"https://github.com/daytonaio/daytona/security/advisories/GHSA-ww63-pv5x-vfc8\n","enisa_id":"EUVD-2026-38565\n","assigner":"GitHub_M","epss":0.4,"dataProcessed":"Nov 7, 2026, 7:20:27 AM","vulnerabilityProduct":[{"id":"73ee8e64-ede1-31d4-9d42-cced30cb1eaf","product":{"name":"daytona","vendor":{"name":"daytonaio"}},"product_version":"0.101.0, \u003c 0.184.0"}],"vulnerabilityVendor":[{"id":"853d71be-8c38-312e-8a1d-1438c87f3cd8","vendor":{"name":"daytonaio"}}]}}],"enisaIdAdvisory":[]}