SurrealDB CVE-2026-63757

Exploitation requires (1) the SurrealDB HTTP /rpc endpoint to be network-reachable to the attacker, and (2) at least one client to have registered an authenticated session via {"method":"attach"} on that HTTP transport - in practice the official Rust SDK's Http/Https engine, which auto-attaches once per Surreal handle. The attacker needs no credentials (PR:N): they enumerate attached UUIDs via the unauthenticated sessions method and then supply the target UUID in the /rpc 'session' field, which the pre-3.1.0 handler accepts without ownership verification. Limiting factors: an attached session that has not yet authenticated is Level::No and confers no privilege; WebSocket /rpc (per-connection scope, attach refused), REST endpoints (/sql, /signin, /key, /export), embedded/MCP usage, and POST /rpc callers that never attach are all NOT exposed. The UI:P metric reflects this dependency on a legitimate client's attach behavior rather than any per-request victim action.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) with VC:H/VI:H/VA:H and a base score of 8.7 indicates a network-reachable, low-complexity, unauthenticated attack with high impact to confidentiality, integrity and availability but no scope change to other systems (SC/SI/SA:N). The single mitigating signal in the vector is UI:P (passive user interaction): exploitation is only possible when a legitimate client has actually attached an authenticated session over HTTP /rpc, so the attack surface depends on victim client behavior rather than being universally exploitable against every default deployment. No CISA KEV listing and no EPSS score are present in the provided data, and no POC is referenced, so this reads as a high-severity, high-confidence-of-mechanism issue without evidence of active or widespread exploitation yet. Net: a genuine priority for anyone running SurrealDB < 3.1.0 with Rust-SDK HTTP clients, but the UI:P precondition means it is not a spray-and-pray internet-wide RCE-equivalent; targeted attacks against known SurrealDB HTTP endpoints are the realistic threat.

An application uses the official Rust SDK's Http engine, which auto-attaches an authenticated (up to root) session to a SurrealDB < 3.1.0 instance reachable on the network. An unauthenticated attacker who can reach /rpc calls the 'sessions' method to list attached UUIDs, then issues an /rpc request carrying a victim's UUID in the 'session' field and is treated as that authenticated session, reading and deleting data and escalating privilege. No public POC is referenced, but the GHSA advisory describes each step precisely.