CVE-2026-54324 — Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join

CVE-2026-54324

Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join PUBLISHED

Description (CNA)

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, a cross-tenant authorization flaw in Daytona's notification WebSocket gateway allowed any authenticated user to subscribe to another organization's realtime notification channel and passively receive that organization's events. This vulnerability is fixed in 0.185.0.

Affected (CNA)

Vendor / product	Versions
daytonaio / daytona	affected < 0.185.0

CWE

CWE-639, CWE-863

References

https://github.com/daytonaio/daytona/security/advisories/GHSA-qwxf-2m7m-2m3x

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.