CVE-2026-66027
Received Received - Intake

Broken Access Control in Suna AI Platform

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: VulnCheck

Description
Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues of all users, read or delete individual sessions, and inject arbitrary prompts into another user's session queue, causing the background drainer to forward malicious messages to the victim's running AI agent with the victim's credentials and permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-66027
EUVD
EUVD-2026-48641

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kortix-ai suna to 0.9.102 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Suna before 0.9.102 has a broken access control flaw in its message queue API. Authenticated attackers can bypass ownership checks to access or manipulate queues belonging to other users. This includes reading pending prompts, deleting sessions, or injecting malicious prompts into another user's queue. The background drainer then forwards these messages to the victim's AI agent using the victim's credentials and permissions.

Detection Guidance

To detect this vulnerability, inspect Suna API endpoints under /v1/queue/* for missing ownership validation. Check if GET /v1/queue/all exposes all queued messages across tenants without proper authorization. Verify filesystem storage in apps/api/src/queue/storage.ts lacks user association checks. Test by attempting to access, modify, or delete messages using another user's session ID with a valid token.

Impact Analysis

If exploited, attackers could read your private prompts, delete your active sessions, or inject harmful prompts into your AI agent. This could lead to unauthorized actions performed on your behalf, data leaks, or compromise of your AI agent's functionality and outputs.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, unauthorized processing of personal data, and failure to maintain proper access controls, potentially leading to regulatory penalties and loss of compliance certifications.

Mitigation Strategies

Upgrade Suna to version 0.9.102 or later to address the broken access control vulnerability in the message queue API. Ensure proper ownership and account isolation checks are implemented to prevent unauthorized access to queue resources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66027. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart