Executive brief
Daytona is an infrastructure platform used to manage and execute AI-generated code and agent workflows. A security flaw in the platform's notification system allowed any logged-in user to eavesdrop on the real-time activity of other organizations. By exploiting this, an attacker could monitor sensitive events such as sandbox and snapshot updates belonging to other customers, potentially leading to the exposure of private operational data.
Technical details
A cross-tenant authorization vulnerability (CWE-639/CWE-863) exists in the Daytona API service's notification WebSocket gateway. During the JWT handshake process, the gateway joined clients to notification 'rooms' based on a user-supplied organization ID without verifying the user's membership in that organization. An authenticated attacker with knowledge of a target organization's UUID could subscribe to their real-time event stream. This exposure includes sandbox, snapshot, volume, and runner events. The vulnerability affects self-hosted deployments (NestJS API application) but does not impact the API-key authentication path. A fix is available in version 0.185.0.
Affected products
- Daytona Daytona >= 0.101.0, < 0.185.0
Timeline
- 2026-06-16: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date