The vulnerability is a broken access control in Suna’s message queue API that permits authenticated users to read, delete, or inject messages in any other user’s prompt queue. Because these queued messages are later processed by the victim’s AI agent using the victim’s credentials, an attacker can cause malicious code or instructions to be executed in the victim’s environment. The flaw corresponds to CWE‑862, reflecting a lack of proper authorization checks.

Kortix‑AI’s Suna software, versions prior to 0.9.102, is affected; all releases before 0.9.102 that have not incorporated the fix are vulnerable.

The CVSS score of 8.7 marks this vulnerability as High severity. The EPSS value of < 1% indicates that the likelihood of exploitation is currently low, yet the flaw remains a significant risk. It is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated attacker with access to the Suna instance who can craft requests to the message queue API. No public exploit code is documented, so the primary risk depends on an attacker’s ability to identify and authenticate to the target system.