CVE-2026-66027: Suna Auth Bypass Vulnerability

CVE-2026-66027 Overview

CVE-2026-66027 is a broken access control vulnerability in Suna, an open-source AI agent platform maintained by Kortix. Versions prior to 0.9.102 expose the message queue API without proper ownership or account isolation checks [CWE-862]. Authenticated attackers can read pending prompt queues belonging to other users, read or delete individual sessions, and inject arbitrary prompts into another user's session queue. The background drainer then forwards attacker-supplied messages to the victim's running AI agent, executing them with the victim's credentials and permissions.

Critical Impact
Any authenticated Suna user can hijack another user's AI agent session, injecting prompts that execute with the victim's identity, data access, and integrations.

Affected Products

Suna (Kortix) versions prior to 0.9.102
Suna message queue API endpoints
Deployments exposing multi-tenant Suna instances

Discovery Timeline

2026-07-24 - CVE-2026-66027 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66027

Vulnerability Analysis

Suna exposes a message queue API used to buffer prompts before they are drained into an AI agent's execution context. The API accepts a session or queue identifier from the authenticated caller but does not verify that the identifier belongs to the caller's account.

Because ownership and account-scope checks are missing, any authenticated user can enumerate and manipulate queues associated with other accounts. This includes reading pending prompts, deleting queued sessions, and, most consequentially, appending arbitrary prompts to a victim's queue.

When the background drainer processes the tampered queue, it forwards the injected prompts to the victim's live agent. The agent runs those prompts with the victim's credentials, tool permissions, and connected integrations, producing a full cross-tenant agent hijack.

Root Cause

The root cause is a missing authorization check [CWE-862] on message queue routes. The handlers trust the client-supplied session identifier and do not join queue records against the caller's accountId. The patch in release 0.9.102 introduces scoped account resolution and ownership assertions before any queue read, write, or delete operation.

Attack Vector

Exploitation requires network access to the Suna API and any valid authenticated account, including a low-privileged tenant. No user interaction from the victim is required. An attacker enumerates or guesses a target session identifier, submits queue read or write requests against that identifier, and the drainer completes the hijack asynchronously.

typescript

// Patch excerpt: apps/api/src/billing/routes/subscriptions.ts
// The fix resolves the caller's scoped account before dispatching
// the request, ensuring cross-tenant identifiers are rejected.
 summary: 'Get details for a Stripe checkout session',
 ...auth,
 request: { params: z.object({ sessionId: z.string() }) },
-responses: { 200: json(OpaqueSchema, 'Checkout session details') },
+responses: {
+  200: json(OpaqueSchema, 'Checkout session details'),
+  ...errors(404),
+},
 }),
 async (c) => {
+  const accountId = await resolveScopedAccountId(c, 'query');
   const sessionId = c.req.param('sessionId');
-  const result = await getCheckoutSessionDetails(sessionId);
+  const result = await getCheckoutSessionDetails(accountId, sessionId);
   return c.json(result);
 },
);

Source: GitHub Commit 7536a7d

Detection Methods for CVE-2026-66027

Indicators of Compromise

Message queue API requests where the caller's account identifier does not match the resolved owner of the target sessionId.
Unexpected prompt entries appearing in agent transcripts that do not correlate with any user-initiated action.
Deletion of queued sessions immediately followed by new prompt writes from a different source IP or user agent.

Detection Strategies

Compare the authenticated principal on each queue request against the account that owns the referenced session, and alert on mismatches.
Baseline per-user queue enumeration rates and flag accounts that iterate through session identifiers across multiple tenants.
Correlate agent-executed actions with the originating prompt's submitting user; alert when the agent acts on prompts from a non-owner.

Monitoring Recommendations

Enable verbose audit logging on all Suna API routes prior to upgrading to 0.9.102.
Forward API and drainer logs to a central analytics platform and retain them for post-incident review.
Track outbound agent actions, including tool invocations and credential use, to detect prompts executed under a hijacked identity.

How to Mitigate CVE-2026-66027

Immediate Actions Required

Upgrade Suna to version 0.9.102 or later, which enforces account-scoped ownership checks on the message queue API.
Rotate credentials, API tokens, and OAuth grants held by any Suna account whose queues may have been accessed by another tenant.
Review agent execution history for prompts and tool calls that cannot be attributed to a legitimate user action.

Patch Information

The fix is delivered in Suna release v0.9.102 via pull request #4373 and commit 7536a7d. Additional context is available in the VulnCheck Access Control Advisory and the GitHub OSS Documentation.

Workarounds

Restrict access to Suna deployments to trusted, single-tenant user populations until the patch is applied.
Place the API behind a reverse proxy that enforces per-account rate limits on queue endpoints to slow enumeration.
Disable or pause the background drainer in shared environments if immediate patching is not possible, accepting the loss of asynchronous prompt processing.

bash

# Verify the running Suna version and upgrade
git fetch --tags
git checkout v0.9.102
# Rebuild and redeploy
pnpm install && pnpm build
# Restart the API and drainer workers
systemctl restart suna-api suna-drainer