SurrealDB CVE-2026-102876

Requires the SurrealDB HTTP interface exposed and a valid Database-level or Namespace-level account (PR:L) - the attacker must already authenticate as some tenant user. Exploitation is meaningful only in multi-tenant deployments where more than one namespace/database shares the instance, so a foreign tenant exists to pivot into. The technique abuses the split between the Surreal-Auth-NS/Surreal-Auth-DB (verified) and Surreal-NS/Surreal-DB (context-selecting) headers on HTTP requests. Limiting factors: Root and anonymous (Level::No) principals are unaffected because they are already unrestricted by can_access_ns_db, and the missing check only mattered once both a namespace and database were selected. No user interaction is needed and no non-default configuration is required beyond running a shared multi-tenant instance on versions before 3.3.0.

This is a genuine, credible priority rather than an inflated high-CVSS score. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:N) is internally consistent with the description and confirmed by the fix commit: a network-reachable HTTP endpoint, low complexity, requires only low privileges (a valid credential for one tenant), no user interaction, and yields high confidentiality and integrity impact with no availability impact. CWE-639 (authorization bypass through a user-controlled key) matches exactly - check_auth() authenticates against the Surreal-Auth-NS/Surreal-Auth-DB headers but builds the session context from the separate, attacker-controlled Surreal-NS/Surreal-DB headers without an access check. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is: no public exploit identified at time of analysis. However, the vulnerability is trivially reproducible (the fix's own regression tests demonstrate the header-pivot with plain HTTP requests), and any competent attacker with a single tenant account could reconstruct it, so the absence of a published POC should not lower urgency for multi-tenant operators. Note the tag says 'Authentication Bypass' but the attacker is in fact authenticated (PR:L) - this is an authorization / cross-tenant access-control bypass, so the tag is imprecise.

In a shared multi-tenant SurrealDB deployment, an attacker who legitimately holds Database- or Namespace-level credentials for their own tenant sends an HTTP /sql request presenting their real credentials in the Surreal-Auth-NS/Surreal-Auth-DB headers while setting Surreal-NS/Surreal-DB to a victim tenant's namespace and database. The session is built against the attacker-chosen context without an access check, so queries execute against the foreign tenant and can read, create, and modify its records. No public POC is provided, but the vendor's regression tests reproduce the pivot with ordinary HTTP requests.