PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54323 daytonaio CVE debrief

CVE-2026-54323 is a MEDIUM severity vulnerability in Daytona, a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to version 0.185.0, the daemon's git clone implementation disabled TLS certificate verification. When a clone request carried Git credentials, the daemon sent the HTTP Basic Authorization header to the remote over a connection whose certificate was never validated, on both the go-git and native git CLI code paths. An attacker able to intercept clone traffic could present any TLS certificate, capture the Git credentials supplied for the clone, and serve tampered repository content into the sandbox. This vulnerability is fixed in version 0.185.0.

Vendor
daytonaio
Product
daytona
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-23
Original CVE updated
2026-06-24
Advisory published
2026-06-23
Advisory updated
2026-06-24

Who should care

Users of Daytona prior to version 0.185.0 should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to version 0.185.0 or later, and ensuring that TLS certificate verification is enabled for git clone operations. Additionally, users should be cautious when using git clone with credentials, and consider using alternative authentication methods.

Technical summary

The vulnerability exists in the Daytona daemon's git clone implementation, where TLS certificate verification is disabled. This allows an attacker to intercept clone traffic, present any TLS certificate, capture Git credentials, and serve tampered repository content into the sandbox. The vulnerability is fixed in version 0.185.0, which enables TLS certificate verification for git clone operations.

Defensive priority

This vulnerability has a CVSS score of 5.9 and a MEDIUM severity rating. Users should prioritize upgrading to version 0.185.0 or later to mitigate this vulnerability.

Recommended defensive actions

  • Upgrade to Daytona version 0.185.0 or later
  • Enable TLS certificate verification for git clone operations
  • Use alternative authentication methods for git clone operations
  • Monitor for suspicious git clone activity
  • Review and update git clone workflows to ensure secure practices

Evidence notes

The CVE-2026-54323 vulnerability was reported via the National Vulnerability Database (NVD) and is tracked under the identifier CVE-2026-54323. The vulnerability has a CVSS score of 5.9 and a MEDIUM severity rating. The vulnerability is fixed in Daytona version 0.185.0.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54323 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54323

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54323 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54323

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.