Security advisories

medium2026-06-18

CVE-2026-54319-Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape

GHSA-fjv8-j4p5-cr9m

medium2026-06-17

CVE-2026-54324-Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join

GHSA-qwxf-2m7m-2m3x

high2026-06-16

CVE-2026-54322-Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles

GHSA-qxvm-pcfm-qc39

high2026-06-16

CVE-2026-54321-Daytona: Public sandbox previews remain accessible for up to one hour after being made private

GHSA-ww63-pv5x-vfc8