PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54320 daytonaio CVE debrief

CVE-2026-54320 is a HIGH-severity vulnerability in Daytona, a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to version 0.184.0, organization invitations could be accepted by users with matching but unverified emails. This issue arises because Daytona authenticates users via OIDC and checks the email in the caller's token against the invitation's target email, but does not require email verification for invitation acceptance or decline. On identity providers allowing self-service signup and issuing sessions before email verification, an attacker could exploit this by registering a matching unverified email address and accepting the invitation, potentially gaining up to Owner role access in the target organization. This vulnerability is fixed in version 0.184.0.

Vendor
daytonaio
Product
daytona
CVSS
HIGH 8.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-23
Original CVE updated
2026-06-24
Advisory published
2026-06-23
Advisory updated
2026-06-24

Who should care

Organizations using Daytona for AI-generated code execution and agent workflows should be aware of this vulnerability, especially if they have not upgraded to version 0.184.0 or later. Security teams and administrators responsible for user invitations and role management within Daytona should prioritize patching and review their current user and invitation management processes.

Technical summary

The vulnerability exists in the organization invitation handling of Daytona, specifically in how it verifies user emails before allowing them to accept or decline invitations. Daytona uses OIDC for user authentication and matches the email in the user's token with the target email of the invitation. However, prior to version 0.184.0, it did not enforce that the email be verified, unlike the process for creating new organizations. This oversight allows an attacker with an unverified email address that matches an invitation to accept it, potentially gaining elevated access within the organization.

Defensive priority

Patching to version 0.184.0 or later is the primary mitigation. Review and adjust user invitation and role management processes to ensure proper email verification and authorization checks are in place.

Recommended defensive actions

  • Apply the patch by upgrading Daytona to version 0.184.0 or later.
  • Review and update user invitation and role management processes to ensure proper email verification.
  • Monitor user activities and role assignments within Daytona for any suspicious changes.
  • Verify email verification status for all users with elevated roles.
  • Implement additional logging and monitoring for organization invitation workflows.

Evidence notes

The CVE-2026-54320 record and associated NVD details were referenced. The vulnerability is described as allowing unverified email users to accept organization invitations, with a CVSS score of 8.4 and HIGH severity. The fix is included in Daytona version 0.184.0.

Official resources

This article is AI-assisted and based on the supplied source corpus.