github.com/daytonaio/daytona vulnerabilities (Go)

4 vulnerabilities.

• github.com/daytonaio/daytona Go Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape CVE-2026-54319 Fix available 4.2 MediumJune 18, 2026
• github.com/daytonaio/daytona Go Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join CVE-2026-54324 Fix available 6.5 MediumJune 17, 2026
• github.com/daytonaio/daytona Go Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles CVE-2026-54322 Fix available 7.7 HighJune 16, 2026
• github.com/daytonaio/daytona Go Daytona: Public sandbox previews remain accessible for up to one hour after being made private CVE-2026-54321 Fix available 7.0 HighJune 16, 2026