Vulnerability in github.com/daytonaio/daytona (CVE-2026-54319)
Summary
Vulnerability in github.com/daytonaio/daytona (CVE-2026-54319). Risk of unauthorized operations or information disclosure. Exploitable via volumeId. Mitigation: upgrade to 0.186.0 or later.
Original description
The description as published by the source.
Summary
A sandbox volume reference (volumeId, which may also be a volume name) was forwarded to the
runner and used to build the host bind-mount source path without confinement. A reference
containing path-traversal sequences could in principle resolve the mount source outside the
intended per-volume base directory.
Impact
Had the traversal been reachable, an authenticated user could have caused the runner to
bind-mount an unintended host path into their sandbox, with a worst-case impact of read and
write access to other tenants' volume data (per-volume FUSE mounts are world-readable and
writable).
Important: this path was not exploitable in any released version. A volume reference is
validated against the database before it reaches the runner, and the volume id column is a
UUID type, so a reference containing traversal sequences is rejected at validation time and
the request fails before any mount is constructed. We could not reproduce cross-tenant access
or an out-of-base host mount on a released build; the observable effect of the documented
payload was a server-side validation error. Severity is assessed as Medium on that basis.
Patches
Fixed in v0.186.0. Volume references are now resolved to the canonical volume UUID
server-side before reaching the runner, so a name can never flow downstream as a path
component, and the runner confines the mount source to the volume base directory and rejects
any non-UUID reference.
Workarounds
Upgrade to v0.186.0 or la…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-54319 has been found in github.com/daytonaio/daytona.
Attackers can target a specific entry point like volumeId over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 4.2/10.
What to do: upgrade github.com/daytonaio/daytona to 0.186.0 or later.
If unsure, ask your IT team or search "github.com/daytonaio/daytona CVE-2026-54319" on the vendor's site.
CVE-2026-54319 (github.com/daytonaio/daytona) — CWE-20 / CVSS v3 4.2
Attack vector: remote (network-reachable) / no user interaction
Attack surface: volumeId
Patched: 0.186.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-20) exists in github.com/daytonaio/daytona. Attackers reach the vulnerable code path via volumeId.
Check the vendor advisory for the affected versions of github.com/daytonaio/daytona. Attack surface: volumeId.
Severity: Medium (CVSS 4.2/10). Risk of unauthorized operations or information disclosure.
Update to 0.186.0.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'github.com/daytonaio/daytona' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'github.com/daytonaio/daytona' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
github.com/daytonaio/daytonaを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade github.com/daytonaio/daytona to 0.186.0ステージング環境で 0.186.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com