Executive brief
Suna, an AI agent platform, contains a security flaw in how it manages message queues. An authorized user can exploit this to view or delete the private data of other users, or even inject malicious instructions into another person's AI session. This could allow an attacker to perform actions on behalf of a victim using the victim's own credentials and permissions.
Technical details
A broken access control vulnerability (CWE-862) exists in the Suna message queue API due to missing ownership and account isolation checks. An authenticated attacker can exploit this via the network to read pending prompt queues of all users, delete individual sessions, or inject arbitrary prompts into another user's session queue. When the background drainer processes these injected messages, they are forwarded to the victim's AI agent and executed with the victim's credentials. The issue is resolved in version 0.9.102.
Affected products
- kortix-ai Suna before 0.9.102
Timeline
- 2026-07-10: patched: Security fixes merged in PR 4373
- 2026-07-11: advisory: Version 0.9.102 released
- 2026-07-24: disclosed: CVE published to NVD
References
- https://github.com/geo-chen/oss/blob/main/suna.md
- https://github.com/kortix-ai/suna/commit/7536a7d47fc93abcb66e677fcc993b390c81296a
- https://github.com/kortix-ai/suna/pull/4373
- https://github.com/kortix-ai/suna/releases/tag/v0.9.102
- https://www.vulncheck.com/advisories/suna-broken-access-control-via-message-queue-api