CVE-2026-108115

Medium

Description

Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector base_url, OpenAPI, Postman, or MCP URLs to reach internal services and cloud metadata endpoints and read responses.

SeverityMedium

CVSS4.9

Exploit probability—

ProductKortix-ai Suna

PublishedOct 10, 2026

First seenOct 10, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update

kortix-ai suna0.13.52 or later

Patches

github.com/kortix-ai/suna/commit/9c949e4d876cd5acf7b23b0a9ee49ca5c53f1332

Vendor advisories

github.com/kortix-ai/suna/releases/tag/v0.13.52

Affected products

Product	Affected versions	Fixed in
kortix-ai suna	0.10.7 ≤ v < 0.13.52	0.13.52

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.