Server-Side Request Forgery Vulnerability in Kortix Suna by Kortix
CVE-2026-108115

2.3LOW

Key Information:

Vendor

Kortix-ai

Status
Suna
Vendor
CVE Published:
10 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-108115?

The Kortix Suna application versions before 0.13.52 are susceptible to a server-side request forgery vulnerability. This issue enables project managers to sidestep the isPrivateIp guard by using IPv6 6to4 or Teredo addresses that incorporate private IPv4 destinations. Malicious actors with project.connector.write privileges can manipulate the connector base_url, OpenAPI, Postman, or MCP URLs, potentially compromising internal services and cloud metadata endpoints to extract sensitive response data.

Affected Version(s)

suna 0.10.7 < 0.13.52

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-108115 - Proof of Concept

References

https://hackmd.io/@haind/suna-ssrf-6to4-guard-bypass
technical-descriptionexploit
https://github.com/kortix-ai/suna
product
https://github.com/kortix-ai/suna/blob/v0.13.45/apps/api/...
technical-description

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.