What is the CVSS score of CVE-2026-54323?

CVE-2026-54323 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-54323?

Yes, a patch is available for CVE-2026-54323. Update the affected software to the latest version immediately.

Daytona CVE-2026-54323

EUVD-2026-38561 MEDIUM

Improper Certificate Validation (CWE-295)

2026-06-23 GitHub_M

RCE Elastic Daytona

5.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

vuln.today AI

5.9 MEDIUM

MITM prerequisite justifies AC:H; no attacker privileges needed (PR:N); clone must be triggered (UI:R); credentials fully exposed (C:H) but integrity impact is limited to tampered repo content (I:L).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 23, 2026 - 20:01 EUVD

Analysis Generated

Jun 23, 2026 - 18:35 vuln.today

DescriptionCVE.org

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, the daemon's git clone implementation disabled TLS certificate verification. When a clone request carried Git credentials, the daemon sent the HTTP Basic Authorization header to the remote over a connection whose certificate was never validated, on both the go-git and native git CLI code paths. An attacker able to intercept clone traffic could present any TLS certificate, capture the Git credentials supplied for the clone, and serve tampered repository content into the sandbox. This vulnerability is fixed in 0.185.0.

AnalysisAI

Git credential exposure in Daytona's daemon (all versions prior to 0.185.0) allows a network-positioned attacker to silently harvest HTTP Basic Authorization headers by exploiting a complete absence of TLS certificate validation on both the go-git and native git CLI clone code paths. An attacker with man-in-the-middle capability on clone traffic can present any fraudulent TLS certificate, capture the Git credentials supplied for the clone, and simultaneously inject tampered repository content into the execution sandbox - threatening both credential confidentiality and supply-chain integrity of AI-generated code workflows. No public exploit or active exploitation has been identified at time of analysis; a vendor-released fix is available in version 0.185.0.

Technical ContextAI

CWE-295 (Improper Certificate Validation) describes the root cause: the Daytona daemon's git clone implementation explicitly disabled TLS server certificate verification on outbound HTTPS clone requests. Because HTTP Basic Authentication encodes credentials in the Authorization request header, skipping certificate validation means the daemon will transmit credentials to any server presenting any TLS certificate - including an attacker-controlled one. Critically, this flaw existed on two independent code paths: the go-git library path and the native git CLI path, meaning there was no fallback-safe code path. The affected product is identified by CPE cpe:2.3:a:daytonaio:daytona:*:*:*:*:*:*:*:* covering all versions up to but not including 0.185.0. Because Daytona is positioned as infrastructure for AI-generated code execution and agent workflows, the integrity impact of serving tampered repository content extends into the execution environment of AI agents.

RemediationAI

Upgrade Daytona to version 0.185.0 or later, which is the vendor-confirmed fix as documented in GitHub Security Advisory GHSA-375h-72g4-hc9c (https://github.com/daytonaio/daytona/security/advisories/GHSA-375h-72g4-hc9c). If immediate upgrade is not possible, the most effective compensating control is to avoid supplying Git credentials to Daytona clone operations over untrusted or shared network segments until the patch is applied; credential exposure requires both the credential to be present in the clone request and an attacker to hold a MITM position on that specific network path. Where possible, restrict Daytona daemon traffic to isolated network segments or private VPCs to reduce MITM surface. Alternatively, use SSH-based Git authentication rather than HTTPS Basic Auth for clone operations, as SSH key-based authentication is not transmitted as a cleartext header and is therefore not subject to this specific credential interception vector - though note this does not eliminate the tampered-content risk if certificate validation is bypassed. Do not rely on network-layer TLS inspection appliances as a mitigation, as they operate at a layer above the daemon's own certificate-bypass behavior.