Executive brief
Daytona is a platform used to run AI-generated code and automated agent workflows in secure, isolated environments. A vulnerability was identified where the system did not properly restrict how storage volumes were mapped to the host server, which could theoretically allow a user to access data belonging to other users. However, because the system validates these requests against a database using strict ID formats, the issue was not exploitable in any released versions.
Technical details
A path traversal vulnerability exists in Daytona's runner component where a sandbox volume reference (volumeId) was used to construct host bind-mount source paths without proper confinement. An attacker could theoretically use traversal sequences to mount host paths outside the intended per-volume directory, potentially leading to cross-tenant data access. In practice, the vulnerability was not exploitable in released versions because the volumeId is validated against a database as a UUID before reaching the runner, causing traversal payloads to fail validation. The fix in version 0.186.0 ensures volume references are resolved to canonical UUIDs server-side and that the runner strictly confines mount sources to the volume base directory.
Affected products
- Daytona Daytona < 0.186.0
Timeline
- 2026-06-17: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD
- 2026-06-23: patched: Fix released in version 0.186.0