CVE-2026-54321: Daytona Sandbox Visibility Cache Bypass (v0.101.0-0.183.1)

Technical summary

The vulnerability stems from a cached visibility state that persists after a sandbox's access control is modified. Specifically, when a sandbox preview transitions from public to private visibility in Daytona versions 0.101.0 through 0.183.1, the authorization cache does not invalidate. This allows the cached public state to serve requests without requiring authentication for a brief period until the cache naturally expires or is refreshed. The issue affects the core authorization layer that protects AI-generated code execution environments.

Business impact

Affected organizations risk unintended exposure of sandboxed AI workloads, which may contain proprietary code generation results, sensitive test data, or customer information. The window of exposure is temporary but unpredictable in duration, making it difficult for users to know if their private previews were accessed during the vulnerable period. This undermines trust in the platform's access control and could expose intellectual property or compliance-sensitive materials if code or data was cached or exfiltrated during the exposure window.

Affected systems

Daytona versions 0.101.0 through 0.183.1 are affected. All deployments running these versions that use sandbox preview functionality are potentially vulnerable if any sandboxes have been transitioned from public to private visibility. The vulnerability does not affect sandboxes that remain in a single visibility state or those running version 0.184.0 or later.

Exploitability

Exploitation requires network access and knowledge that a specific sandbox exists and was recently changed to private. An attacker cannot force the visibility change themselves; they must time their request to coincide with the cache invalidation window after a legitimate user makes the change. The attack surface is limited to publicly discoverable sandbox identifiers and requires no authentication or special privileges. The CVSS score of 7.0 (HIGH) reflects the high confidentiality impact, moderate integrity and availability impact, and moderate complexity (requiring specific timing).

Remediation

Upgrade Daytona to version 0.184.0 or later. Before upgrading, review audit logs or access records for any sandboxes that were changed from public to private during the past several months to determine if unauthorized access may have occurred. If sandboxes containing sensitive code or data were exposed, assume they may have been accessed and treat any related intellectual property or credentials as potentially compromised.

Patch guidance

Apply the patch by upgrading to Daytona 0.184.0 or a later release. Verify the upgrade against the vendor's release notes to confirm that cache invalidation for visibility changes is included. Test in a non-production environment first to ensure compatibility with your deployment model and any custom configurations. Schedule the upgrade during a maintenance window, as sandbox availability may be temporarily affected during the upgrade process.

Detection guidance

Review Daytona's access logs and visibility change audit trails for the period during which your deployment ran versions 0.101.0 through 0.183.1. Look for unauthenticated requests to sandboxes that were marked private shortly before the request timestamp. Check for any unexpected IP addresses or geographic origins accessing private sandboxes. Monitor for any subsequent suspicious activity (API calls, code execution) originating from private sandboxes during the vulnerable window. Enable enhanced logging or audit retention before applying patches to capture baseline behavior post-remediation.

Why prioritize this

This vulnerability should be prioritized based on the sensitivity of code and data stored in sandboxes at your organization. If sandboxes contain proprietary AI-generated code, customer data, or credentials, the HIGH severity rating and confidentiality impact warrant rapid patching. The unpredictable exposure window and difficulty in retroactively determining access make immediate remediation preferable to delayed patching. Organizations managing AI workflows with compliance or IP concerns should prioritize within the next 1-2 weeks.

Risk score, explained

The CVSS 3.1 score of 7.0 reflects a HIGH severity vulnerability due to high confidentiality impact (the primary concern), combined with low integrity and availability impact. The attack vector is network-based and requires no privileges, but attack complexity is rated as high because exploitation depends on timing relative to visibility changes. The vulnerability does not allow privilege escalation or system-wide compromise, but it does create a meaningful risk of unauthorized data disclosure.

Frequently asked questions