CVE-2026-54323

Name of the Vulnerable Software and Affected Versions Daytona versions prior to 0.185.0

Description The daemon's git clone implementation disables TLS certificate verification. When a clone request includes Git credentials, the daemon transmits the HTTP Basic Authorization header to the remote server over a connection with an unvalidated certificate. This occurs in both the go-git and native git CLI code paths. An attacker capable of intercepting clone traffic could use a fraudulent TLS certificate to capture the supplied Git credentials and inject tampered repository content into the sandbox.

Recommendations Update to version 0.185.0.