Loading story…
Suna versions before 0.9.102 contain a high-severity broken access control flaw in the /v1/queue/* API that let any authenticated user access and manipulate other users’ queue resources on the same deployment. Reports describe missing ownership and account-isolation checks that exposed queued messages across a multi-tenant instance, with the GET /v1/queue/all endpoint returning pending prompts for all sessions instead of enforcing per-account filtering.
The vulnerability allowed attackers to read pending prompt queues, read or delete individual sessions, and inject arbitrary prompts into another user’s session queue; those injected messages could then be forwarded by Suna’s background drainer to the victim’s running AI agent using the victim’s credentials and permissions. The issue was assigned CVE-2026-66027, scored 8.7 under CVSS 4.0, and is reported fixed in version 0.9.102, with remediation focused on upgrading and enforcing strict ownership, isolation, and access controls in the queue handlers.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
On 24 July 2026, CVE and advisory coverage described a high-severity broken access control flaw in Suna's message queue API affecting versions before 0.9.102. The advisories said authenticated attackers could read all users' pending queues, delete or read sessions, and inject prompts that may be executed by a victim's AI agent under the victim's credentials.
The GitHub report says the vulnerability was noted as fixed on 13 July 2026 in pull request #4373, which was later deleted. Other references describe the remediation as updating Suna to version 0.9.102 or later.
According to the GitHub report, the vulnerability was escalated publicly on 5 July 2026 after no response to the initial disclosure. The escalation concerned the same cross-tenant queue access and prompt injection weakness.
The GitHub report states the cross-tenant IDOR and queue isolation failure in Suna's /v1/queue/* API was disclosed on 3 June 2026. The issue affected authenticated users on the same deployment by allowing access to and manipulation of other users' queued agent prompts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple high-severity vulnerabilities in **Open WebUI** allow attackers to plant malicious chat content that executes when viewed, leading to theft of JWTs and session tokens from `localStorage`, full account takeover, and compromise of sensitive AI assets. The flaws affect markdown rendering, citation and response iframe handling, and HTML file-serving paths, including cases where attacker-controlled content was rendered with dangerous HTML processing or iframe sandbox settings such as `allow-scripts allow-forms allow-same-origin`. Reported impacts include exposure of DOM data, `indexedDB`, cookies, backend API keys, model parameter files, private databases, and other enterprise AI resources. Several reports warn that if an administrator opens a malicious shared transcript or chat, the attack can escalate from stored XSS to **remote code execution** through Open WebUI's administrative features and Python-based functions or plugins, potentially yielding code execution on the Docker container or local host. The issues were addressed across releases including **v0.6.6** and **v0.7.0** by tightening file ownership checks, removing or making optional same-origin iframe access, and recommending stronger HTML sanitization and restrictive CSP settings; one report also provided a database query to hunt for stored chats containing suspicious `data:text/html` or `javascript:` embed payloads.
Jul 7, 2026
A critical vulnerability, **CVE-2026-82533**, in DeepSeek Harness allows attacker-influenced AI coding agents to bypass the tool’s local control-plane authentication and switch their own sessions to `danger-full-access`. The HTTP API trusted a client-supplied `Host` header instead of validating the TCP peer, enabling a sandboxed agent to reach the loopback interface, disable file-write restrictions and approval prompts, and execute privileged commands without credentials, user approval, configuration changes, or external network exposure. The flaw affects DeepSeek Harness `0.1.1-rc.2` and earlier. It can also expose stored conversations and session logs; remote attackers would require an existing port forward, tunnel, or proxy because the CLI does not bind externally by default. DeepSeek addressed the issue by adding one-time-token authentication, with fixed releases reported from `0.1.2-alpha.1` onward; organizations should update to a current patched release and review local API exposure, tunnels, proxies, and potentially compromised session data.
Sep 9, 2026
OpenClaw disclosed several high-severity vulnerabilities affecting multiple releases, including authorization bypass in QQBot pre-dispatch slash commands, privilege escalation in the trusted-proxy Control UI WebSocket, and node authority expansion through pairing reconnection logic. The QQBot issue, tracked as **`CVE-2026-53834`** and mirrored in GitHub advisory **`GHSA-77pv-3w4q-vrj5`**, affects versions up to **`2026.4.26`** and allows senders to trigger slash-command handling before `allowFrom` policy checks are enforced. The vendor said the flaw is limited to the QQBot feature and its configuration, with the first stable fix released in **`2026.4.27`**.
Jun 29, 2026