https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 20:49:08 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-330144 EUVD-2026-330144 https://cve.radiocsirt.org/vuln/euvd-2026-330144 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54321 <p>Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. From 0.101.0 until 0.184.0, sandbox previews that were switched from public to private could remain reachable without authentication for a short period after the change, due to a cached visibility state that was not invalidated when the sandbox&#39;s visibility changed. This vulnerability is fixed in 0.184.0.</p> <p>Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. From 0.101.0 until 0.184.0, sandbox previews that were switched from public to private could remain reachable without authentication for a short period after the change, due to a cached visibility state that was not invalidated when the sandbox&#39;s visibility changed. This vulnerability is fixed in 0.184.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54321 https://cve.radiocsirt.org/vuln/ghsa-ww63-pv5x-vfc8 <p><strong>Affected:</strong> Go: github.com/daytonaio/daytona</p> <p>### Summary Sandbox previews that were switched from public to private could remain reachable without authentication for a short period after the change, due to a cached visibility state that was not invalidated when the sandbox&#39;s visibility changed.</p> <p>### Impact When a sandbox owner changed a preview from public to private, the preview proxy could continue serving unauthenticated requests to that sandbox&#39;s ordinary preview ports for a bounded period before the change took effect. Only sandboxes that had been made public and were later set back to private were affected, and only until the proxy&#39;s cached visibility state was refreshed. Terminal, toolbox, and recording-dashboard ports were never affected, as those always require authentication. The issue did not involve cross-tenant access, privilege escalation, or remote code execution.</p> <p>### Patches Fixed in v0.184.0. Sandbox visibility changes now invalidate the proxy&#39;s cached preview state immediately, so revoking a public preview takes effect on the next request.</p> <p>### Workarounds Upgrade to v0.184.0 or later. There is no configuration workaround for earlier versions.</p> <p>### Credit Reported through Daytona&#39;s Vulnerability Disclosure Program by **mrknightnidu(nidalkhan)**. **Linkedin**: https://www.linkedin.com/in/mrknight-nidu-031340328/</p> <p><strong>Affected:</strong> Go: github.com/daytonaio/daytona</p> <p>### Summary Sandbox previews that were switched from public to private could remain reachable without authentication for a short period after the change, due to a cached visibility state that was not invalidated when the sandbox&#39;s visibility changed.</p> <p>### Impact When a sandbox owner changed a preview from public to private, the preview proxy could continue serving unauthenticated requests to that sandbox&#39;s ordinary preview ports for a bounded period before the change took effect. Only sandboxes that had been made public and were later set back to private were affected, and only until the proxy&#39;s cached visibility state was refreshed. Terminal, toolbox, and recording-dashboard ports were never affected, as those always require authentication. The issue did not involve cross-tenant access, privilege escalation, or remote code execution.</p> <p>### Patches Fixed in v0.184.0. Sandbox visibility changes now invalidate the proxy&#39;s cached preview state immediately, so revoking a public preview takes effect on the next request.</p> <p>### Workarounds Upgrade to v0.184.0 or later. There is no configuration workaround for earlier versions.</p> <p>### Credit Reported through Daytona&#39;s Vulnerability Disclosure Program by **mrknightnidu(nidalkhan)**. **Linkedin**: https://www.linkedin.com/in/mrknight-nidu-031340328/</p> https://cve.radiocsirt.org/vuln/ghsa-ww63-pv5x-vfc8