Daytona EUVD-2026-38565

Requires all of the following: (1) the target Daytona sandbox preview was previously set to public and the attacker obtained or guessed its preview URL while it was public; (2) the owner has just toggled that preview from public to private; (3) the request hits the preview proxy before the cached visibility state refreshes (bounded window, up to ~1 hour per advisory). Exploitation is limited to ordinary preview ports - terminal, toolbox, and recording-dashboard ports always require authentication and are not affected - and yields no cross-tenant access, privilege escalation, or code execution; high attack complexity (AC:H) reflects the timing race and prior-knowledge requirement.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L scoring 7.0 reflects an internet-reachable, unauthenticated condition but with high attack complexity, which fits the race-against-cache-expiry nature of the bug - the attacker must already know (or guess) the preview URL of a sandbox that very recently transitioned from public to private. No EPSS, KEV, SSVC, or POC signals were provided, and the GitHub advisory tags 'RCE' and 'Privilege Escalation' directly conflict with the advisory body, which states the issue does not involve cross-tenant access, privilege escalation, or RCE - those tags appear to be miscategorized and should not drive prioritization. Realistic risk is moderate and narrowly scoped: it matters most to Daytona operators whose users rely on the public-to-private toggle as a security boundary for sensitive in-progress work, and exposure ends as soon as the cache refreshes or the instance is upgraded.

An attacker who already knows the URL of a Daytona sandbox preview that was recently public - for example one shared in a chat, demo, or commit - repeatedly polls that URL after the owner switches it to private, and continues to receive unauthenticated responses with potentially sensitive in-development content until the proxy's cached visibility state refreshes (up to roughly an hour per the advisory title). No public exploit is identified at time of analysis; exploitation is opportunistic rather than a remote takeover.