CVE-2026-54324

Name of the Vulnerable Software and Affected Versions Daytona versions 0.101.0 through 0.184.0

Description A cross-tenant authorization flaw exists in the notification WebSocket gateway of the Daytona API service (apps/api NestJS application). The JWT handshake joins a client-supplied organization identifier to the corresponding notification room without verifying if the authenticated user is a member of that organization. This allows any authenticated user with knowledge of a target organization's UUID to subscribe to its realtime notification channel and passively receive events related to sandboxes, snapshots, volumes, and runners, including the data contained within those events. This results in a cross-tenant confidentiality break. The API-key authentication path is not affected.

Recommendations Update to version 0.185.0.