Suna Message Queue Broken Access Control Leading to Cross-User Prompt Injection
First seen Jul 24, 2026 · Updated Jul 24, 2026 · CVSS 8.3
Suna versions before 0.9.102 fail to enforce ownership checks on the message queue API, letting any authenticated user read, delete, or inject messages into other users' prompt queues. This allows an attacker to inject arbitrary prompts that are forwarded by the background drainer to a victim's running AI agent, executed with the victim's own credentials and permissions.
Technical Analysis
The vulnerability stems from missing per-account authorization checks on queue and session resources in the message queue API, a classic IDOR/broken access control flaw applied to an agentic messaging pipeline. An authenticated attacker can enumerate or guess queue/session identifiers belonging to other tenants and directly read pending prompts, delete sessions, or insert crafted messages. Because the background drainer trusts queue contents and forwards them to the victim's live agent session, injected messages are treated as legitimate first-party input, effectively achieving remote prompt injection with the victim's identity and tool permissions. This crosses a critical trust boundary: attacker-controlled data enters the agent's instruction stream without any origin validation, enabling data exfiltration, unauthorized tool invocation, or full session hijacking depending on the victim's connected tools.
Affected Systems
Suna
Detection Signatures
- Queue/session API requests where the authenticated user ID does not match the resource owner ID
- Unexpected read/delete operations on session IDs not created by the requesting account
- Anomalous message insertions into a session queue from an account with no prior association to that session
- Spikes in queue read/delete calls across many distinct session IDs from a single account (enumeration behavior)
- Agent execution logs showing prompt content inconsistent with the victim's normal usage patterns or containing instructions to exfiltrate data/invoke unrelated tools
Remediation Steps
- 1
Upgrade Suna
Update to Suna 0.9.102 or later, which fixes the broken access control issue.
- 2
Enforce resource ownership checks
Add server-side authorization validation on every queue/session API call to confirm the requesting account owns the target resource.
- 3
Adopt non-guessable resource identifiers
Use unpredictable, per-tenant scoped identifiers (e.g., UUIDs bound to account context) rather than sequential or easily enumerable IDs.
- 4
Audit historical queue access
Review logs for cross-account queue reads/deletes/injections during the vulnerable window and notify affected users.
- 5
Add drainer-side origin validation
Have the background drainer verify message provenance and reject queue entries lacking a valid, session-matched authentication context before forwarding to the agent.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.