Kortix Suna EUVD-2026-96339

The attacker must be an authenticated user holding the project.connector.write permission (project-manager role) on a Suna instance running an affected version (0.10.7 up to but not including 0.13.52). They must supply a connector base_url, OpenAPI, Postman, or MCP URL encoded as an IPv6 6to4 (2002::/16) or Teredo (2001:0::/32) address whose embedded IPv4 points at an internal/RFC1918 host or the 169.254.169.254 cloud metadata endpoint; plain private IPv4 is already blocked by isPrivateIp. Limiting factors: this is not remotely unauthenticated - it needs insider connector-write privilege, requires crafting a valid 6to4/Teredo wrapper (reflected as AC:H/AT:P), only works against server deployments that reach the target internal network, and is fully remediated in v0.13.52.

This is a genuinely low-priority issue despite being an SSRF with cloud-metadata reach. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N) scores only 2.3, and that low score is credible rather than a case of 'high CVSS, low real risk' - the opposite problem. The attack requires an already-trusted insider: a user holding the project.connector.write permission (PR:L, so authenticated), plus a crafted non-trivial IPv6 encoding (AC:H and AT:P reflect the present attack requirement of building valid 6to4/Teredo wrappers around private IPv4 targets). Impact is capped at partial read of responses (VC:L/VI:L, VA:N) and partial subsequent-system impact (SC:L/SI:L) - consistent with reading internal service and metadata endpoint responses but not full credential theft or write. A public POC exists (VulnCheck advisory plus a hackmd technical write-up), which raises practical exploitability, but there is NO EPSS score provided and NO CISA KEV listing, so there is no evidence of active or widespread exploitation - the signal is 'exploit code available, no observed exploitation.' The POC and low CVSS are consistent with each other: an authenticated-only, config-dependent SSRF bypass. Note one missing signal explicitly: EPSS is absent from the input, so widespread-exploitation probability cannot be quantified here.

A user granted project-manager rights (project.connector.write) in a self-hosted Suna instance configures a connector's base_url, OpenAPI, Postman, or MCP URL to an IPv6 6to4 (e.g. 2002:a9fe:a9fe::) or Teredo address that embeds 169.254.169.254 or an RFC1918 host. The isPrivateIp guard fails to decode the embedded private IPv4, Suna fetches the URL server-side, and the attacker reads back cloud metadata or internal service responses. A public proof-of-concept and technical write-up exist, but exploitation requires the attacker to already hold the connector-write privilege.