MEDIUM4.2Go
GHSA-fjv8-j4p5-cr9m· CVE-2026-54319, GO-2026-5367Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape
Modified: 7/20/2026
package
Go/github.com/daytonaio/daytona
pkg:go/github.com/daytonaio/daytona
MEDIUM6.5Go
GHSA-qwxf-2m7m-2m3x· CVE-2026-54324, GO-2026-5598Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join
Modified: 7/20/2026
HIGH7.7Go
GHSA-qxvm-pcfm-qc39· CVE-2026-54322, GO-2026-5600Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles
Modified: 7/20/2026
HIGH7.0Go
GHSA-ww63-pv5x-vfc8· CVE-2026-54321, GO-2026-5729Daytona: Public sandbox previews remain accessible for up to one hour after being made private
Modified: 7/20/2026
—Go
GO-2026-5367· CVE-2026-54319, GHSA-fjv8-j4p5-cr9mDaytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape in github.com/daytonaio/daytona
Modified: 6/25/2026
—Go
GO-2026-5598· CVE-2026-54324, GHSA-qwxf-2m7m-2m3xDaytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join in github.com/daytonaio/daytona
Modified: 6/25/2026
—Go
GO-2026-5600· CVE-2026-54322, GHSA-qxvm-pcfm-qc39Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles in github.com/daytonaio/daytona
Modified: 6/25/2026
—Go
GO-2026-5729· CVE-2026-54321, GHSA-ww63-pv5x-vfc8Daytona: Public sandbox previews remain accessible for up to one hour after being made private in github.com/daytonaio/daytona
Modified: 6/25/2026