CVE-2026-108115

Publié : 10 octobre 2026

Modifié : 10 octobre 2026

Score CVSS

4.9

MEDIUM

Description détaillée

Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector base_url, OpenAPI, Postman, or MCP URLs to reach internal services and cloud metadata endpoints and read responses.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Références et Patchs

https://github.com/kortix-ai/suna https://github.com/kortix-ai/suna/blob/v0.13.45/apps/api/src/shared/ssrf-guard.ts#L98-L113 https://github.com/kortix-ai/suna/commit/9c949e4d876cd5acf7b23b0a9ee49ca5c53f1332 https://github.com/kortix-ai/suna/releases/tag/v0.13.52 https://hackmd.io/@haind/suna-ssrf-6to4-guard-bypass https://www.vulncheck.com/advisories/kortix-suna-0.10.7-before-0.13.52-ssrf-guard-bypass-via-ipv6-6to4-addresses

Dernières Vulnérabilités

CVE-2026-94160

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4.

VOIR DÉTAILS

CVE-2026-62044

Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.

VOIR DÉTAILS

CVE-2026-108586

1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not <granted-tag> to list and invoke tools on backend MCP servers outside their granted scopes.

VOIR DÉTAILS