CVE-2026-54323: Daytona TLS Certificate Bypass in Git Clone Operations

Technical summary

CVE-2026-54323 is a TLS certificate verification bypass (CWE-295) affecting Daytona's git clone implementation in versions prior to 0.185.0. Both the go-git and native git CLI code paths disabled certificate validation on HTTPS connections. When clone operations included Git credentials via HTTP Basic Authentication, those credentials traversed unauthenticated TLS sessions vulnerable to man-in-the-middle (MITM) interception. An attacker able to ARP-spoof, DNS-hijack, or otherwise intercept network traffic could present arbitrary certificates, capture base64-encoded credentials from the Authorization header, and serve tampered repository content into the sandbox environment. The vulnerability requires network positioning and user interaction (triggering a clone with credentials), yielding a CVSS 3.1 score of 5.9 (MEDIUM: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N).

Business impact

Organizations using Daytona to execute AI-generated code face supply-chain contamination risk. An attacker with network access could compromise the integrity of cloned repositories and the sandboxed code execution that follows. If Daytona is deployed in CI/CD pipelines or used by developers to validate AI-generated workflows, malicious code injection could propagate downstream—affecting build artifacts, deployed services, or further automated processes. The credential capture aspect is particularly concerning: Git tokens or deploy keys sent during clone operations could be harvested for lateral movement or unauthorized repository access. The breach is silent; developers would not observe evidence of certificate rejection, trusting the cloned content as legitimate.

Affected systems

Daytona versions prior to 0.185.0 are affected. The vulnerability affects both the go-git and native git CLI code paths, making it broadly present in the daemon's clone functionality regardless of which backend a user's configuration selects. Any deployment of Daytona performing git clone operations with authentication credentials is at risk if deployed in network environments where traffic interception is possible.

Exploitability

Exploitation requires network-level access to intercept Git clone traffic—typically feasible for attackers on the same local network, operating malicious DNS resolvers, or present at ISP/transit points. The attacker must also trigger or coincide with a clone operation that includes credentials (high ACME value reflects this dependency on user action and connection circumstance). No special privileges, complexity in target code, or user awareness of security mechanics is needed beyond the clone action itself; the TLS bypass is automatic. The attack is not trivial for remote attackers without network positioning, but is straightforward for local or in-transit attackers, explaining the MEDIUM severity despite credential capture impact.

Remediation

Update Daytona to version 0.185.0 or later. This release restores TLS certificate verification on both go-git and native git CLI code paths. Verify the fix is enabled in your deployment configuration; do not disable certificate validation intentionally. Organizations should also audit any Git credentials that were in use in versions prior to 0.185.0 and consider rotating them if deployed in networks where interception may have occurred.

Patch guidance

1. Identify all Daytona instances running versions before 0.185.0 (check daemon version via API or process inspection). 2. Plan upgrades during maintenance windows; there is no evidence of in-the-wild exploitation. 3. Test 0.185.0 or later in a staging environment to confirm git clone operations (with and without credentials) function normally. 4. Deploy the patched version, restarting affected daemons. 5. Optionally audit recent clone operations in logs to detect any MITM indicators (connection errors, certificate warnings that were silently ignored, or unexpected repository content). 6. Rotate Git credentials (deploy keys, PATs, SSH keys) that were used pre-patch as a defensive measure.

Detection guidance

1. Network-level: Monitor for TLS handshakes where clients accept invalid/self-signed certificates during Git operations; flag anomalies. 2. Application-level: Examine Daytona daemon logs for clone operations; look for any messages indicating certificate errors that were bypassed (this would be an indicator of pre-0.185.0 behavior). 3. Credential audit: If possible, cross-reference Git credentials used in clone commands against any logs from network taps or MITM proxies in your environment—a difficult forensic task but worthwhile if sensitive deploy keys were in use. 4. Behavioral: Monitor for unexpected repository content or build artifacts that appear to originate from unvetted or tampered clones; apply code review rigor to AI-generated code paths. 5. Post-patch: Verify that 0.185.0+ is rejecting invalid certificates (e.g., by blocking a test clone from a MITM proxy).

Why prioritize this

MEDIUM CVSS and lack of active exploitation (not on KEV list) suggest this is not an emergency, but the combination of credential theft risk and code integrity compromise in an AI execution platform warrants prompt remediation. Daytona users in CI/CD or AI code validation roles should prioritize this within 2–4 weeks. Organizations with Daytona in isolated, trusted networks face lower risk; those in cloud or multi-tenant settings should accelerate patching.

Risk score, explained

The CVSS 3.1 score of 5.9 reflects high confidentiality impact (credential capture, AV:N), low integrity impact (code tamper is localized to the sandbox, IS:L), no availability impact, high attack complexity (network interception required, AC:H), and required user interaction (clone invocation, UI:R). The score appropriately weighs the realistic threat (MITM is non-trivial to execute remotely) against the sensitive nature of credentials and code.

Frequently asked questions