CVE-2026-54319: Daytona Path-Traversal Sandbox Escape—Patch to 0.186

Technical summary

CVE-2026-54319 is a path-traversal vulnerability in Daytona's sandbox volume handling. The vulnerability exists in how volumeId parameters (which can be either volume identifiers or names) are processed when constructing host bind-mount source paths. Prior to version 0.186, insufficient path confinement allowed sequences like '../' or similar traversal patterns to escape the designated per-volume base directory. The runner component receives the unvalidated volumeId and uses it directly in path construction, enabling directory traversal. This maps to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), CWE-250 (Execution with Unnecessary Privileges), and CWE-269 (Improper Access Control).

Business impact

This vulnerability primarily affects organizations running Daytona for AI code execution and agentic workflows. The exposure is limited to authenticated users, reducing the attack surface for most deployments, but the ability to access files outside sandboxed volumes could compromise code integrity, expose sensitive training data, or allow modification of execution environments. For AI development teams relying on Daytona for secure, isolated code generation and testing, this creates a sandbox-escape risk that could undermine trust in the platform's isolation guarantees.

Affected systems

Daytona versions prior to 0.186 are affected. The vulnerability requires authenticated access and depends on the runner implementation accepting and processing the unvalidated volumeId. Organizations should verify their installed version and check whether volume mounting features are exposed to trusted or semi-trusted users in their deployment model.

Exploitability

Exploitation requires valid credentials (PR:L in the CVSS vector), making this suitable for insider threats or compromised user accounts. The attack complexity is rated as high, suggesting successful exploitation may depend on specific deployment configurations or knowledge of the exact volume structure. No active exploits are currently tracked in the CISA Known Exploited Vulnerabilities catalog. The barrier to exploitation is meaningful, but the simplicity of path-traversal attacks means security teams should assume patch deployment is necessary.

Remediation

Upgrade Daytona to version 0.186 or later, which includes path-confinement fixes for volume reference handling. Organizations running earlier versions should prioritize this upgrade within their maintenance windows. After patching, verify that volume mounting works as expected in test environments before full production rollout. Review access controls around volume mounting capabilities to ensure they are granted only to necessary user roles.

Patch guidance

The fix is available in Daytona version 0.186 and later. Vendors and maintainers should consult the official Daytona release notes and advisories to confirm the exact version available for your deployment model (cloud-hosted, self-hosted, or containerized). Plan upgrades during low-usage periods to minimize disruption to AI development workflows. Test the upgrade in a non-production environment to confirm compatibility with your volume mounting configurations and any integrations.

Detection guidance

Monitor for volumeId parameters containing path-traversal sequences (e.g., '..', '%2e%2e', or similar encoded variants) in requests to volume-mounting endpoints. Log and alert on volume references that resolve to paths outside expected base directories. Examine sandbox execution logs for attempts to access files in unexpected locations. If available, enable audit logging for volume operations in your Daytona deployment to capture mount-related activities.

Why prioritize this

Although the CVSS score is moderate (4.2), this vulnerability warrants timely patching because it directly undermines sandbox isolation—a critical security property for any system executing untrusted or AI-generated code. The requirement for authentication reduces immediate risk, but insider threats and compromised accounts are persistent risks in development environments. Early patching prevents a potential foothold for lateral movement or data exfiltration within trusted infrastructure.

Risk score, explained

The CVSS 3.1 score of 4.2 (MEDIUM) reflects limited impact (only confidentiality and integrity, no availability impact), requirement for authenticated access, and high attack complexity. However, the severity understates the value of the sandbox abstraction in code-execution platforms; even limited sandbox escape is operationally significant. Organizations deeply dependent on Daytona's isolation properties should consider this a higher operational priority than the numeric score alone suggests.

Frequently asked questions