🚨High - Suna Message-Queue Broken Access Control with Cross-User Prompt Injection (CVE-2026-66027) Suna (before 0.9.102), Kortix's open-source AI-agent platform, fails to enforce ownership and account-isolation checks in its message-queue API. An authenticated attacker can read every user's pending prompt queue, read or delete other users' sessions, and inject arbitrary prompts into another user's session queue. The background drainer then forwards those attacker prompts to the victim's running AI agent, executed with the victim's own credentials and permissions - enabling data theft and unwanted actions on the victim's behalf. Any logged-in user can do this, and a public PoC exists. CVSS 8.7. 👉Upgrade Suna to 0.9.102.
Post summary
A high‑severity CVE-2026-66027 involving cross‑user prompt injection is disclosed, a public PoC exists, and users are urged to upgrade to version 0.9.102 to mitigate the risk.
