Suna

A broken access control vulnerability in Suna's message queue API allows authenticated attackers to gain unauthorized access to and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. This exploit enables attackers to read all users' pending prompt queues, read or delete individual sessions, and inject arbitrary prompts into another user's session, which causes the background drainer to forward malicious messages to the victim's AI agent using their credentials and permissions, leading to potential data manipulation, unauthorized actions, or further compromise.