CVE-2026-108115
Received Received - Intake

Kortix Suna Server-Side Request Forgery via IPv6 Addresses

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: VulnCheck

Description
Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector base_url, OpenAPI, Postman, or MCP URLs to reach internal services and cloud metadata endpoints and read responses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-108115
EUVD
EUVD-2026-96339

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kortix-ai suna 0.10.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108115 is a Server-Side Request Forgery (SSRF) vulnerability in Kortix Suna versions 0.10.7 through 0.13.51. It allows authenticated project managers with write permissions to bypass SSRF protections by using IPv6 6to4 or Teredo addresses that embed private IPv4 addresses. This lets attackers set malicious URLs in connectors like base_url, OpenAPI, Postman, or MCP to access internal services and cloud metadata endpoints.

Detection Guidance

To detect this vulnerability, check if your Suna instance is running a version between 0.10.7 and 0.13.51. Use the command: curl -s https://your-suna-instance/api/version | grep version. If the version is below 0.13.52, the system is vulnerable. Additionally, inspect network logs for outbound requests to IPv6 6to4 or Teredo addresses that embed private IPv4 destinations.

Impact Analysis

If you are a project manager with write permissions in Kortix Suna versions 0.10.7 to 0.13.51, an attacker could exploit this to access internal systems, cloud metadata, or sensitive data by crafting malicious URLs. Even without direct access, if your system interacts with Suna, it may be exposed to SSRF risks.

Compliance Impact

This vulnerability could lead to unauthorized access to internal systems or cloud metadata, potentially exposing sensitive data. This may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information, depending on the data accessed.

Mitigation Strategies

Immediately upgrade Suna to version 0.13.52 or later. This version includes fixes for the SSRF guard bypass via IPv6 6to4 and Teredo addresses. Use the command: kortix update suna --version 0.13.52. After upgrading, verify the fix by testing with known malicious IPv6 addresses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108115. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart