CVE-2026-54323 Details
Description
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, the daemon's git clone implementation disabled TLS certificate verification. When a clone request carried Git credentials, the daemon sent the HTTP Basic Authorization header to the remote over a connection whose certificate was never validated, on both the go-git and native git CLI code paths. An attacker able to intercept clone traffic could present any TLS certificate, capture the Git credentials supplied for the clone, and serve tampered repository content into the sandbox. This vulnerability is fixed in 0.185.0.
A vulnerability exists in Daytona versions prior to 0.185.0, where the daemon's git clone function disabled TLS certificate verification. This flaw allowed the daemon to send Git credentials via the HTTP Basic Authorization header over unverified connections, on both the go-git and native git CLI paths. As a result, an attacker intercepting the clone traffic could capture the Git credentials, typically a personal access token or password, and inject tampered repository content into the execution sandbox.
Users are advised to upgrade to Daytona version 0.185.0 or later, where TLS certificate verification is enforced by default for git clones, aligning with the existing verification for pull and push operations. For those unable to upgrade immediately, it is recommended to avoid using Git credentials with clones that may pass through untrusted networks until a patched version is installed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 23, 2026CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/daytonaio/daytona/security/advisories/GHSA-375h-72g4-hc9c | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Daytonaio Daytona | <= 0.184.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |