Auth bypass in Kortix-ai Suna
CVE-2026-66027
Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account i…
Vulnerability class: Broken Access Control
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L.
Affected products
- Kortix-ai Suna — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (technical-description, exploit)
- disclosure@vulncheck.com (release-notes, patch)
- disclosure@vulncheck.com (issue-tracking, patch)
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-66027?
- CVE-2026-66027 is a high-severity vulnerability in Kortix-ai Suna, classified under Missing Authorization. CVSS score: 8.3/10. Published 2026-07-24.
- How severe is CVE-2026-66027?
- High severity. CVSS v3 base score is 8.3 out of 10.