Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, the daemon's git clone implementation disabled TLS certificate verification. When a clone request carried Git credentials, the daemon sent the HTTP Basic Authorization header to the remote over a connection whose certificate was never validated, on both the go-git and native git CLI code paths. An attacker able to intercept clone traffic could present any TLS certificate, capture the Git credentials supplied for the clone, and serve tampered repository content into the sandbox. This vulnerability is fixed in 0.185.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-54323 Disabled TLS Certificate Verification in Daytona Prior to 0.185.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54323
Post summary
The entry reports a TLS certificate verification flaw in Daytona versions earlier than 0.185.0 and notes the fix available from version 0.185.0, providing a link to detailed vulnerability information.