CVE-2026-108115

MEDIUM 4.9

Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses

CVSS Score

4.9

EPSS Score

0.0%

EPSS Percentile

0th

Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector base_url, OpenAPI, Postman, or MCP URLs to reach internal services and cloud metadata endpoints and read responses.

CWE	CWE-918
Vendor	kortix-ai
Product	suna
Published	Oct 10, 2026

Stay Ahead of the Next One

Get instant alerts for kortix-ai suna

Be the first to know when new medium vulnerabilities affecting kortix-ai suna are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

kortix-ai / suna

0.10.7 < 0.13.52

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@haind/suna-ssrf-6to4-guard-bypass github.com: https://github.com/kortix-ai/suna github.com: https://github.com/kortix-ai/suna/blob/v0.13.45/apps/api/src/shared/ssrf-guard.ts#L98-L113 github.com: https://github.com/kortix-ai/suna/commit/9c949e4d876cd5acf7b23b0a9ee49ca5c53f1332 github.com: https://github.com/kortix-ai/suna/releases/tag/v0.13.52 vulncheck.com: https://www.vulncheck.com/advisories/kortix-suna-0.10.7-before-0.13.52-ssrf-guard-bypass-via-ipv6-6to4-addresses

Credits

HaiND from the Post and Telecommunication Institute of Technology