CVE-2026-108115 in Suna
Summary
by MITRE • 10/10/2026
Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector base_url, OpenAPI, Postman, or MCP URLs to reach internal services and cloud metadata endpoints and read responses.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in Kortix Suna versions prior to 0.13.52 represents a critical server-side request forgery flaw that exploits the application's handling of network address translation and IPv6 tunneling protocols. Specifically, the defect lies within the validation logic governing project manager privileges, where an attacker possessing the project.connector.write permission can manipulate connector configuration parameters such as base_url, OpenAPI specifications, Postman collections, or Model Context Protocol URLs. The core technical failure involves a bypass of the isPrivateIp guard mechanism designed to restrict outbound requests from reaching internal network resources and cloud metadata endpoints. This security control typically functions by inspecting destination IP addresses to ensure they do not fall within reserved private address ranges defined in RFC 1918, thereby preventing external-facing services from initiating connections into the local infrastructure or accessing sensitive instance metadata provided by cloud providers like AWS EC2 Instance Metadata Service or Azure Managed Identity endpoints.
The exploitation vector relies on the specific behavior of IPv6 transition technologies, namely 6to4 and Teredo addressing schemes. These protocols are designed to facilitate connectivity for hosts that lack native IPv6 support by encapsulating IPv4 packets within IPv6 datagrams. In this vulnerability scenario, an attacker constructs a malicious URL or endpoint configuration using an IPv6 address formatted according to these tunneling standards. By embedding private IPv4 addresses directly into the payload of the 6to4 or Teredo header, the resulting destination appears as a valid public IPv6 address to the initial parsing layer of the application's network stack. However, when the underlying operating system or networking library processes this packet for egress, it decapsulates the data and resolves the actual target IP address from the inner payload. Consequently, the outbound request is directed toward an internal private IPv4 address rather than a public internet resource, effectively circumventing the application-level firewall rules that rely solely on superficial string matching of the outer IPv6 address without performing deep packet inspection or recursive resolution checks against known private ranges.
The operational impact of this vulnerability is severe, as it grants attackers with moderate privileges the ability to perform internal network reconnaissance and data exfiltration from services that are not intended to be accessible via public-facing interfaces. By directing requests to cloud metadata endpoints, an attacker can retrieve temporary security credentials, access keys, and configuration details associated with the running instance or container environment. This information is often sufficient for privilege escalation within the broader infrastructure, allowing the compromise of other systems through stolen API tokens or service account secrets. Furthermore, the ability to reach internal services enables attackers to probe for additional vulnerabilities in backend databases, message queues, or microservices that are typically isolated from external traffic by network segmentation policies. This effectively neutralizes perimeter defenses and allows lateral movement within the trusted zone of the deployment environment.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically illustrating how improper validation of user-supplied input can lead to unauthorized access to internal resources. It also relates closely to CWE-200 Information Exposure and CWE-643 Improper Mitigation for XPATH Injection or similar injection flaws if the embedded data is processed further, though the primary issue remains SSRF due to the lack of robust destination validation. In terms of threat modeling under MITRE ATT&CK, this behavior corresponds to T1598 Phishing for Information within a Multi-Target Campaign when used in conjunction with social engineering, but more directly maps to T1071 Application Layer Protocol if leveraging standard web protocols, and critically T1652 Compromised Cloud Credentials via metadata service access. The exploitation technique demonstrates how attackers can abuse legitimate protocol features like IPv6 tunneling to evade security controls that do not account for encapsulated payloads.
Mitigation strategies must focus on implementing rigorous input validation and network-level filtering at multiple layers of the architecture. At the application level, developers should ensure that any URL or IP address provided by users is resolved and validated against a comprehensive list of private IPv4 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) as well as other reserved address blocks such as link-local and loopback addresses. This validation must occur after DNS resolution and IP parsing to prevent bypasses via domain names that resolve to private IPs or through encapsulated protocols like IPv6 tunneling, HTTP redirects, or DNS rebinding attacks. It is essential to perform recursive checks on the final destination IP address rather than relying solely on the initial input string format. Additionally, network-level controls should be employed using egress firewalls or cloud security groups that explicitly deny traffic destined for private IP ranges from public-facing instances, providing a defense-in-depth approach even if application-layer validation fails. Upgrading to Kortix Suna version 0.13.52 or later is the primary remediation step as it addresses this specific logic flaw in the connector configuration handling and strengthens the isPrivateIp guard against IPv6 tunneling bypasses.