surrealdb vulnerabilities

Latest high and critical flaws

• CVE-2026-109343 SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the calHigh 8.6 · Oct 12, 2026
• CVE-2026-109341 SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by High 7.1 · Oct 12, 2026
• CVE-2026-109338 SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embeHigh 7.1 · Oct 12, 2026
• CVE-2026-109335 SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissiHigh 7.1 · Oct 12, 2026
• CVE-2026-109334 SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticaHigh 8.6 · Oct 12, 2026
• CVE-2026-109333 SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or dHigh 7.1 · Oct 12, 2026
• CVE-2026-102876 SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and SurrealHigh 8.6 · Sep 29, 2026
• CVE-2026-63763 SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability.High 7.5 · Jul 20, 2026
• CVE-2026-63760 SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheseHigh 8.7 · Jul 20, 2026
• CVE-2026-63759 SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations.High 7.1 · Jul 20, 2026
• CVE-2026-63757 SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authenticatHigh 8.7 · Jul 20, 2026
• CVE-2026-63756 SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit autCritical 9.2 · Jul 20, 2026
• CVE-2026-63755 SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEHigh 7.1 · Jul 20, 2026
• CVE-2026-63754 SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREAHigh 7.1 · Jul 20, 2026
• CVE-2026-63747 SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace.High 8.7 · Jul 20, 2026
• CVE-2026-63746 SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references.High 7.1 · Jul 20, 2026
• CVE-2026-63740 SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users, leaking denied array elements instead High 7.1 · Jul 20, 2026
• CVE-2026-63739 SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that allows database users with EDITOR or OWNER roles High 8.3 · Jul 20, 2026
• CVE-2026-63737 SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of High 7.1 · Jul 20, 2026
• CVE-2026-63735 SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in differenHigh 8.6 · Jul 20, 2026
• CVE-2025-71397 SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or databHigh 7.1 · Jul 18, 2026
• CVE-2025-71395 SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when usHigh 7.1 · Jul 18, 2026
• CVE-2025-71392 SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command.Critical 9.4 · Jul 18, 2026
• CVE-2025-71391 SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database.High 7.1 · Jul 18, 2026
• CVE-2024-58370 SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idiomHigh 7.1 · Jul 18, 2026