EUVD-2026-45927
GHSA-fmh9-9m2w-q5p4
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 20, 2026
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-active authenticated sessions via a TOCTOU race condition on the HTTP /rpc endpoint — the primary interface used by all official SurrealDB SDKs. Because concurrent requests share mutable authentication state, an unauthenticated request that races in before the state is cleared executes as the authenticated user, potentially escalating to root. No public exploit is identified at time of analysis, but the flaw is credited by VulnCheck and carries a high CVSS 4.0 score of 9.2.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Surrealdb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (vulncheck) · only source for this CVE.
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated session state. Unauthenticated attackers can send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active to execute operations with hijacked user privileges.
Executive ViewAI
SurrealDB before version 3.1.0 contains a critical privilege escalation flaw affecting its primary API endpoint used by all official SDKs, allowing unauthenticated attackers to hijack active user sessions and impersonate authenticated users including administrators. Organizations using SurrealDB in production face immediate risk of data exfiltration, unauthorized modification, and lateral movement. The flaw impacts both single-tenant and multi-tenant deployments where concurrent API requests are expected.
Within 24 hours: Document and inventory all SurrealDB deployments (versions, internet exposure, data sensitivity), and prioritize systems in internet-facing, multi-tenant, or production environments. Within 7 days: Implement compensating controls including network segmentation of /rpc endpoints, WAF rules to detect anomalous request patterns targeting concurrent sessions, and API rate limiting. Within 30 days: Monitor SurrealDB vendor advisories for patch release information, develop an upgrade plan to version 3.1.0 or later once available, and plan immediate patching cycles for systems handling sensitive data; consider evaluation of alternative solutions if patch timeline extends beyond acceptable risk windows.
No vendor-released patch identified at time of analysis; no public exploit identified at time of analysis. Interim mitigations: restrict network access to /rpc endpoint via firewall or load-balancer; deploy WAF rules detecting rapid successive or concurrent /rpc requests from single sources; implement API rate limiting per client and session; enable request and session logging with anomaly detection for authentication state changes; isolate SurrealDB instances to internal networks only; segment data access by deployment tier; evaluate running in single-user or connection-pooled modes to reduce session concurrency; monitor vendor advisory channels for patch release information and prepare rapid deployment pipeline.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
SurrealDB versions before 3.3.0 fail to validate a caller's authorization level when the SurrealQL USE statement switche
Cross-tenant data access in SurrealDB before 3.3.0 allows an authenticated namespace- or database-level SYSTEM user to b
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB versions before 3.3.0 lets a query-capable authenticated user with embedded JavaScript sc
Authenticated SurrealDB record users can read field values that field-level SELECT permissions are meant to conceal on S
Exploit-DB