CVE-2026-54324: Cross-Tenant Authorization Bypass in Daytona Notification Gateway

Technical summary

CVE-2026-54324 is a cross-tenant authorization bypass (CWE-639, CWE-863) in Daytona's WebSocket-based notification gateway. The flaw stems from insufficient validation of tenant isolation on subscription requests. An authenticated user can craft WebSocket subscribe messages targeting arbitrary organization identifiers, and the gateway fails to enforce proper authorization checks before granting access to that tenant's event stream. Because the WebSocket connection itself is authenticated at the user level but tenant membership is not re-validated per subscription, an attacker bypasses the intended multi-tenant segmentation. The issue is read-only—no privilege elevation or state modification occurs—but provides unrestricted passive access to another organization's real-time operational telemetry.

Business impact

Information exposure across organizational boundaries introduces compliance and competitive risk. In regulated environments (fintech, healthcare, energy), passively observing another tenant's event stream may violate data residency or confidentiality obligations. For SaaS platforms using Daytona, this enables corporate espionage vectors: an attacker subscribed to a competitor's or partner's notification channel could infer operational patterns, deployment timing, or system health. The passive nature means detection is difficult, extending the window of unnoticed compromise. Multi-tenant customers must assume their events may have been observed by unauthorized parties if Daytona instances ran unpatched between June 2026 and the patch deployment date.

Affected systems

Daytona versions prior to 0.185.0 are affected. The vulnerability exists in the notification WebSocket gateway, affecting any deployment that exposes real-time event subscriptions to networked clients. All authenticated users on a shared Daytona instance can exploit this flaw; no special privileges are required. Organizations running Daytona as an AI code execution backend for agent workflows or batch processing are in scope if they enable the notification subsystem.

Exploitability

Exploitability is straightforward for any authenticated user. The attack requires no user interaction, no special tooling beyond a WebSocket client, and succeeds over the network with only a valid login credential to the Daytona instance. An attacker need only discover or guess valid organization identifiers and subscribe to their notification channels. The low attack complexity and lack of social engineering make this a trivial post-authentication attack. However, the prerequisite of valid authentication (even as a low-privileged user) limits the attack surface to insider threats or compromise of legitimate accounts.

Remediation

Upgrade Daytona to version 0.185.0 or later. This patch introduces proper per-subscription tenant authorization validation on the WebSocket gateway, ensuring users can only subscribe to channels corresponding to their organization. Verify patch installation by confirming the running version and by testing that cross-tenant subscription attempts are rejected. Organizations unable to patch immediately should restrict network access to the Daytona notification gateway (e.g., VPN-only or IP allowlist) and monitor WebSocket connection logs for anomalous subscription attempts to unexpected organization identifiers.

Patch guidance

Apply version 0.185.0 to all running Daytona instances. If using a managed or containerized deployment, pull the latest image tagged 0.185.0 or higher. Verify the upgrade by checking `daytona --version` or the admin API version endpoint. No data migration is required. Test notification subscriptions from a client in your organization to confirm functionality is maintained post-patch. Consider a staged rollout if Daytona serves production AI workflows, to avoid disruption during the WebSocket gateway restart.

Detection guidance

Search for WebSocket subscription attempts in Daytona logs that reference organization identifiers not matching the authenticated user's tenant. If audit logs are available, look for patterns of repeated cross-tenant subscription requests from a single user account, which may indicate enumeration. Monitor for unusual increases in notification gateway traffic or connection counts from specific authenticated users. If you suspect exploitation, correlate WebSocket connection timestamps with user login history to identify which accounts may have been used. Implement alerting on any subscription request rejection (post-patch) to detect ongoing attempts by residual compromised accounts.

Why prioritize this

While the CVSS score is 6.5 (MEDIUM), the risk warrants prompt patching because: (1) multi-tenant information disclosure is a foundational trust violation in SaaS platforms; (2) the attack is trivial post-authentication, making it attractive to insiders or low-skill attackers with a compromised account; (3) the passive read-only nature makes detection and attribution difficult, so undetected compromise may be ongoing; (4) the fix is low-risk and requires only a version upgrade. Organizations in regulated industries or running competing workloads on the same Daytona instance should prioritize this higher.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects the moderate impact of read-only cross-tenant information disclosure (Confidentiality: High) balanced against the requirement for prior authentication (Privilege Required: Yes). No integrity or availability impact lowers the score below 7.0. However, the *ease* of exploitation and the *trust boundary* violation mean real-world risk may feel higher to multi-tenant operators; prioritize based on your tenant isolation requirements and regulatory posture, not score alone.

Frequently asked questions