EUVD-2026-45928
GHSA-32pg-rjqh-fhfp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and low-complexity with no attacker auth (PR:N), but exploitation depends on a legitimate client having attached an authenticated session, mapped from CVSS 4.0 UI:P to UI:R; full C/I/A impact within the DB with no scope change.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.
AnalysisAI
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the HTTP /rpc 'sessions' method and then impersonate any authenticated session by supplying an arbitrary 'session' field that the /rpc handler never ownership-checks. Because impersonation inherits the victim session's authorization, an anonymous caller can read, write, and delete data and escalate to that session's level, up to root. There is no public exploit identified at time of analysis, but the vendor GHSA advisory documents the mechanism in full detail, making reproduction straightforward.
Technical ContextAI
SurrealDB is a modern multi-model (document/graph/relational) database that exposes an RPC surface over both HTTP and WebSocket. The flaw is a CWE-306 (Missing Authentication for Critical Function) issue in the HTTP transport: the /rpc 'sessions' method returned every attached session UUID with no authentication, and the /rpc handler accepted a client-supplied 'session' field without verifying that the caller owned it. 'Attached' sessions are those registered via {"method":"attach"} - the only writer to the HTTP session map - which is how the official Rust SDK's Http/Https engine behaves (it auto-attaches once per Surreal handle). Ordinary stateless /rpc requests use ephemeral per-request sessions that are filtered from sessions() and destroyed at end of request, so they are never enumerable. The combination of an unauthenticated enumeration primitive plus an unverified session-selection parameter turns knowledge of a UUID into full impersonation.
RemediationAI
Vendor-released patch: upgrade to SurrealDB 3.1.0 or later, in which HTTP sessions() now returns method_not_allowed, the /rpc handler gates client-supplied session IDs against the caller's request-level auth principal (actor id + level) and returns session_not_found on mismatch, and attached HTTP sessions are capped via the SURREAL_HTTP_MAX_ATTACHED_SESSIONS environment variable (patch commit https://github.com/surrealdb/surrealdb/commit/fd800fc7c55afcdc97057d18cf7cb7f83557e702). Where immediate upgrade is impossible, the vendor states no configuration-level mitigation fully addresses the flaw, but you can reduce exposure by avoiding SDKs and client flows that call attach against HTTP /rpc - notably the Rust SDK's Http/Https engine - and instead using the WebSocket transport (per-connection scope, attach refused) or REST endpoints (/sql, /signin, /key, /export) that never populate the attached-session map; the trade-off is a client transport change. Additionally restrict /rpc to trusted clients at the network layer (firewall/allowlist or reverse-proxy auth), accepting that this only limits reachability and does not close the underlying missing-authentication gap. Advisory: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-5qfp-32cf-69jh.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Broken authorization in SurrealDB before 3.1.4 allows record-scoped (authenticated) users to read array elements that fi
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today