What happened
A researcher-disclosed vulnerability (CVE-2026-66027, CVSS 8.3/8.7, published July 24 2026) found that Suna's message queue API lacked per-user ownership checks, letting any authenticated attacker inject arbitrary prompts directly into another user's live agent session, effectively achieving cross-tenant prompt injection with the victim's own permissions.
Why it matters
This is a direct, authenticated cross-tenant prompt-injection primitive against a live agentic AI platform — an attacker can weaponize another user's already-authorized agent to perform actions (data exfiltration, destructive operations, further pivoting) entirely within that victim's trust boundary, which is a uniquely dangerous class of vulnerability specific to multi-tenant agentic AI deployments.
Attack vector
Authenticated attackers exploit missing ownership/account-isolation checks in the message queue API to read pending prompt queues of all users, read or delete individual sessions, and inject arbitrary prompts into another user's session queue — causing the background drainer to forward the malicious prompt to the victim's running AI agent, which then executes it with the victim's own credentials and permissions.
Affected systems
Suna (kortix-ai/suna) before 0.9.102
Mitigation
Upgrade to Suna 0.9.102 or later (patch commit 7536a7d, GitHub PR #4373); audit for unauthorized queue access/session manipulation on pre-patch deployments.