Tools AI Risk Radar ai-incident-0210
Incident record
Suna fixes an IPv6 bypass in outbound-request checks
- Severity
- Medium
- Status
- Patched
- Type
- Infra Vuln
- Target
- Kortix Suna from 0.10.7 to before 0.13.52
- Actor
- researcher
- CVE
- CVE-2026-108115
What happened
Certain IPv6 encodings can hide a private IPv4 destination from Suna’s outbound-request checks, allowing requests to internal services on networks that route those addresses.
The public fix was committed on 6 October, version 0.13.52 was released on 7 October and the CVE was published on 10 October. The described attack requires project connector-write permission and suitable network routing. The CNA gives CVSS 3.1 score 4.9. Version 0.13.52 fixes the issue.
Sources
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-108115
- Researcher disclosurehackmd.io/@haind/suna-ssrf-6to4-guard-bypass
- Maintainer fixgithub.com/kortix-ai/suna/commit/9c949e4d876cd5acf7b23b0a9ee…
- Fixed releasegithub.com/kortix-ai/suna/releases/tag/v0.13.52
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026