Executive brief
Daytona is a platform used to run and manage AI-generated code in secure environments. A security flaw allowed sandbox environments that were recently changed from 'public' to 'private' to remain accessible to the public for up to one hour. This could lead to unauthorized access to sensitive code or data within those sandboxes during the window before the security settings fully updated.
Technical details
An authorization bypass exists in Daytona's preview proxy due to insufficient cache invalidation. When a sandbox's visibility is changed from public to private, the proxy continues to serve unauthenticated requests based on a cached 'public' state for a bounded period (up to one hour). The vulnerability is limited to ordinary preview ports; terminal, toolbox, and dashboard ports are unaffected as they always require authentication. Attackers can exploit this by accessing the preview URL of a sandbox that was recently made private. The issue is resolved in version 0.184.0, which ensures visibility changes immediately invalidate the proxy's cached state.
Affected products
- daytonaio daytona >= 0.101.0, < 0.184.0
Timeline
- 2026-06-05: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date
- 2026-06-23: patched: Fix released in version 0.184.0