CVE-2026-66027 in suna
Summary
by MITRE • 07/24/2026
Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues of all users, read or delete individual sessions, and inject arbitrary prompts into another user's session queue, causing the background drainer to forward malicious messages to the victim's running AI agent with the victim's credentials and permissions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability resides in the message queue API of Suna versions prior to 0.9.102 and represents a critical broken access control flaw that undermines fundamental security principles of user isolation and resource ownership. The issue stems from the absence of proper authorization checks within the queue management system, allowing authenticated users to bypass normal access controls and gain unauthorized access to resources belonging to other users. This weakness directly violates established security practices and creates a significant attack surface that can be exploited by malicious actors who have already obtained legitimate credentials. The vulnerability manifests through missing ownership verification mechanisms and account isolation controls that should normally prevent cross-user resource access within the system's messaging infrastructure.
The technical implementation of this flaw enables attackers to perform several dangerous operations through the compromised message queue API. Victims can read pending prompt queues belonging to all users within the system, effectively gaining visibility into other users' unprocessed requests and potentially sensitive data contained within these queues. Additionally, the vulnerability permits unauthorized deletion of individual user sessions, which can disrupt service availability and potentially cause data loss for affected users. Perhaps most critically, attackers can inject arbitrary prompts into another user's session queue, creating a sophisticated attack vector that allows malicious actors to manipulate AI agent behavior on behalf of victims. This injection capability enables the background drainer process to forward attacker-controlled messages to victim sessions, effectively executing commands with the victim's credentials and permissions.
The operational impact of this vulnerability extends beyond simple data access violations and creates substantial risks for system integrity and user privacy. When malicious prompts are injected into victim sessions, the AI agents execute these commands using the victim's authentication context and access rights, potentially enabling privilege escalation attacks or unauthorized actions within the system. This scenario effectively allows attackers to perform operations that would normally be restricted to legitimate users, creating a dangerous situation where compromised accounts can be used to attack other systems or users within the same network. The vulnerability essentially creates a backdoor through which attackers can maintain persistent access and execute commands across multiple user sessions without detection.
Organizations affected by this vulnerability should implement immediate mitigations including patching to version 0.9.102 or later, which addresses the missing authorization checks in the message queue API. Security teams must also conduct comprehensive audits of all queue management systems to identify similar access control gaps within their infrastructure. The implementation of proper ownership verification mechanisms and account isolation controls should be prioritized across all messaging components, ensuring that each user's resources remain properly segregated from others. Additionally, monitoring and logging of queue operations should be enhanced to detect unauthorized access attempts or suspicious injection patterns that could indicate exploitation of this vulnerability.
This vulnerability aligns with CWE-285, which addresses improper authorization issues in software systems, and represents a clear violation of the principle of least privilege. From an ATT&CK framework perspective, this weakness maps to techniques involving privilege escalation through access control manipulation and credential theft via session hijacking. The attack pattern described here demonstrates how authenticated access can be leveraged to escalate privileges and compromise multiple user accounts simultaneously, making it particularly dangerous in multi-tenant environments or systems where users share common infrastructure components. Organizations should also consider implementing network segmentation and additional authentication layers to reduce the impact of such vulnerabilities in their overall security posture.