Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 10 total.
Denial of service in SurrealDB JSON parser via nested objects (CVE-2026-63760)
The SurrealDB value and JSON parser did not enforce the configured recursion depth limit when processing nested braces, brackets, or parentheses. An unauthenticated remote attacker can exploit this by sending a deeply...
Fixed in 3.1.0
Denial of Service via nested type annotations in SurrealDB (CVE-2026-63759)
SurrealDB's type/kind parser failed to enforce the configured recursion depth limit when processing nested type annotations, unlike the expression parser which already applied this limit. An authenticated attacker can...
Fixed in 3.1.0
Session hijacking via unauthenticated /rpc session enumeration in SurrealDB (CVE-2026-63757)
The HTTP `/rpc` `sessions` method in SurrealDB returned all attached session UUIDs without requiring authentication, and the `/rpc` handler accepted arbitrary session identifiers with no ownership verification. An una...
Fixed in 3.1.0
Permission check bypass in SurrealDB SELECT and update statements (CVE-2026-63755)
SurrealDB evaluates user-supplied WHERE clauses and SET/MERGE/CONTENT/PATCH clauses against full record data before enforcing table-level PERMISSIONS FOR SELECT WHERE restrictions. An authenticated user, including Rec...
Fixed in 3.1.0
Denial of service via malicious LIVE queries in SurrealDB (CVE-2026-63754)
A LIVE query whose WHERE clause evaluates to an error causes the error to propagate to the triggering write transaction, rolling back the attempted change. An authenticated user with only select permission on a table ...
Fixed in 3.1.0
Denial of service via malformed RPC `use` call in SurrealDB (CVE-2026-63747)
SurrealDB's RPC `use` handler panics when a database is specified without a namespace, because the handler calls `.expect("namespace should be set")` and the core library is built with `panic = 'abort'`, causing the p...
Fixed in 3.1.0
Array element-level SELECT permission bypass in SurrealDB (CVE-2026-63740)
SurrealDB fails to correctly enforce element-level (`field.*`) SELECT permissions for record users. Instead of hiding denied array elements, the engine leaks a subset of them due to incorrect index handling during per...
Fixed in 3.1.4
Arbitrary file read via DEFINE ANALYZER mapper filter in SurrealDB (CVE-2026-63739)
SurrealDB's DEFINE ANALYZER mapper() filter allows database users with the EDITOR or OWNER role to specify arbitrary file paths and retrieve file contents through query error messages. File access is intended to be re...
Fixed in 3.1.5
Denial of service via deep operator chains in SurrealDB (CVE-2026-63737)
Authenticated users can crash a SurrealDB server by submitting a single query containing a long chain of operators (e.g., tens of thousands of chained addition terms). The query is parsed into an unbounded expression ...
Fixed in 3.1.5
Tenant scope bypass in SurrealDB custom API routes (CVE-2026-63735)
Authenticated users in any namespace/database can invoke custom API endpoints belonging to other namespaces/databases by specifying the target scope in the URL path or via namespace/database headers. The route applied...
Fixed in 3.2.0