🟠 《高危安全漏洞：CVE-2026-66027》

CVSS 评分: 高危（8.7）　　状态: Received　　发布时间: 2026-07-24

漏洞描述

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues of all users, read or delete individual sessions, and inject arbitrary prompts into another user's session queue, causing the background drainer to forward malicious messages to the victim's running AI agent with the victim's credentials and permissions.

🔍 技术细节

字段 值
CVE ID CVE-2026-66027
CVSS 评分 8.7 🟠
严重程度 高危
CVSS 向量 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE 分类 CWE-862
发布时间 2026-07-24
最后更新 2026-07-24
状态 Received
数据来源 disclosure@vulncheck.com

🔗 参考链接