Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.3

Kortix Suna allows internal network access via IPv6 trick

CVE-2026-108115 · published 8 days ago
Summary

Versions of Kortix Suna before 0.13.52 let a user who can change connector URLs point them to internal services, including cloud metadata, by using special IPv6 addresses that hide private IPs. This can expose internal systems and data to outsiders. Update to version 0.13.52 or later, or restrict who can modify connector URLs, to prevent the issue.

What to do
  • Update kortix-ai suna to version 0.13.52 or later.
Affected software
VendorProductAffected versions
kortix-ai suna < 0.13.52
Original advisory text
Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses
Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector base_url, OpenAPI, Postman, or MCP URLs to reach internal services and cloud metadata endpoints and read responses.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published10 Oct 2026
Updated16 Oct 2026
First seen10 Oct 2026
Sources
CVE-2026-108115 · NVD
CVE-2026-108115 · MITRE
CVE-2026-108115 · OSV
Track software like this
Free during beta