Suna
Monthly
We are tasked to produce a JSON analysis for CVE-2026-66027 based on the provided data. The analysis must synthesize all the information, cross-reference, and produce a coherent summary, technical context, risk assessment, affected products, remediation, exploit scenario, exploitation conditions, attack chain, confidence notes, prevalence, prevalence basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. We have: - CVE: CVE-2026-66027 - Description: broken access control in message queue API of Suna before 0.9.102, allowing authenticated attackers to access/manipulate other users' queue resources. Can read pending prompt queues, read/delete individual sessions, inject prompts into another user's session queue, causing background drainer to forward malicious messages to victim's running AI agent with victim's credentials. - CVSS Score: 8.7 (base score based on CVSS 4.0 vector given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N) - CWE: CWE-862 (Missing Authorization) - Multi-source: EPSS 0.26% (percentile 17%) so low exploitation probability. POC/Exploit: Publicly available. Patch: Available from vendor. Reported by VulnCheck. - CPE: cpe:2.3:a:kortix-ai:suna:*:*:*:*:*:*:*:* (so product is Suna from kortix-ai). - Tags: Authentication Bypass, Suna - SSVC: Exploitation: poc, Automatable: no, Technical Impact: total. - ENISA EUVD ID confirms affected versions: suna 0 <0.9.102. So all versions before 0.9.102 are affected. - References: - exploit: https://github.com/geo-chen/oss/blob/main/suna.md (likely a writeup) - release: https://github.com/kortix-ai/suna/releases/tag/v0.9.102 - pull request: https://github.com/kortix-ai/suna/pull/4373 (security fix PR) - patch commit: https://github.com/kortix-ai/suna/commit/7536a7d47fc93abcb66e677fcc993b390c81296a - vulncheck advisory: https://www.vulncheck.com/advisories/suna-broken-access-control-via-message-queue-api - NVD link: https://nvd.nist.gov/vuln/detail/CVE-2026-66027
Reflected cross-site scripting in Suna's authentication endpoint allows remote attackers to execute arbitrary JavaScript in a victim's browser by manipulating the returnURL parameter passed to Next.js router.replace/router.push. All Suna releases from 0.8.0 through 0.8.38 are affected; the flaw spans every auth action (signIn, signUp, resetPassword, signInWithPassword, signUpWithPassword, sendOtpCode, resendMagicLink, installOwner) because none sanitized the returnUrl form field before use. A public proof-of-concept exploit exists (GitHub Gist by TrebledJ); no public exploitation confirmed and the vulnerability is not listed in CISA KEV.
We are tasked to produce a JSON analysis for CVE-2026-66027 based on the provided data. The analysis must synthesize all the information, cross-reference, and produce a coherent summary, technical context, risk assessment, affected products, remediation, exploit scenario, exploitation conditions, attack chain, confidence notes, prevalence, prevalence basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. We have: - CVE: CVE-2026-66027 - Description: broken access control in message queue API of Suna before 0.9.102, allowing authenticated attackers to access/manipulate other users' queue resources. Can read pending prompt queues, read/delete individual sessions, inject prompts into another user's session queue, causing background drainer to forward malicious messages to victim's running AI agent with victim's credentials. - CVSS Score: 8.7 (base score based on CVSS 4.0 vector given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N) - CWE: CWE-862 (Missing Authorization) - Multi-source: EPSS 0.26% (percentile 17%) so low exploitation probability. POC/Exploit: Publicly available. Patch: Available from vendor. Reported by VulnCheck. - CPE: cpe:2.3:a:kortix-ai:suna:*:*:*:*:*:*:*:* (so product is Suna from kortix-ai). - Tags: Authentication Bypass, Suna - SSVC: Exploitation: poc, Automatable: no, Technical Impact: total. - ENISA EUVD ID confirms affected versions: suna 0 <0.9.102. So all versions before 0.9.102 are affected. - References: - exploit: https://github.com/geo-chen/oss/blob/main/suna.md (likely a writeup) - release: https://github.com/kortix-ai/suna/releases/tag/v0.9.102 - pull request: https://github.com/kortix-ai/suna/pull/4373 (security fix PR) - patch commit: https://github.com/kortix-ai/suna/commit/7536a7d47fc93abcb66e677fcc993b390c81296a - vulncheck advisory: https://www.vulncheck.com/advisories/suna-broken-access-control-via-message-queue-api - NVD link: https://nvd.nist.gov/vuln/detail/CVE-2026-66027
Reflected cross-site scripting in Suna's authentication endpoint allows remote attackers to execute arbitrary JavaScript in a victim's browser by manipulating the returnURL parameter passed to Next.js router.replace/router.push. All Suna releases from 0.8.0 through 0.8.38 are affected; the flaw spans every auth action (signIn, signUp, resetPassword, signInWithPassword, signUpWithPassword, sendOtpCode, resendMagicLink, installOwner) because none sanitized the returnUrl form field before use. A public proof-of-concept exploit exists (GitHub Gist by TrebledJ); no public exploitation confirmed and the vulnerability is not listed in CISA KEV.