EUVD-2026-45929
GHSA-mf42-3c8q-x7x8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, low-privilege authenticated attack with no scope change; only limited integrity and availability impact, no confidentiality loss.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions of other users without ownership verification.
AnalysisAI
Authorization bypass in SurrealDB's KILL statement before version 3.1.0 allows any authenticated database-level user to silently terminate other users' LIVE SELECT real-time subscriptions by targeting their live query UUIDs, with no ownership verification performed. The affected user receives no notification of termination, breaking real-time data pipelines and multi-tenant isolation guarantees - a low-privilege record-scoped user can disrupt a root user's monitoring subscriptions within the same database. Discovered during a cure53 code audit and penetration test; no public exploit code or CISA KEV listing exists at time of analysis.
Technical ContextAI
SurrealDB is a multi-model database written in Rust that exposes a real-time subscription mechanism via LIVE SELECT statements, each identified by a randomly generated UUID. The KILL statement, implemented in core/src/expr/statements/kill.rs, is the mechanism to terminate these subscriptions. The flawed implementation performs only a valid_for_db() check confirming the requesting user has database-level access, then directly resolves and deletes the target live query entry by UUID without ever comparing the requesting user's authentication context to the recorded owner of that live query. This is a textbook CWE-862 (Missing Authorization) flaw - authorization is checked at the resource class level (database access) but not at the resource instance level (ownership of the specific live query). The affected package is rust/surrealdb versions prior to 3.1.0.
RemediationAI
The primary fix is to upgrade to SurrealDB 3.1.0 or later, which introduces an ownership verification check in the KILL statement implementation (patch commit 36f0a41a69b551172c7d1d13b1e8dbbd868e2ead) that compares the requesting user's authentication context against the recorded live query owner before permitting deletion. For operators unable to upgrade immediately, the vendor recommends treating live query UUIDs as sensitive credentials - scrub them from application logs, error messages, and shared monitoring dashboards to eliminate the secondary disclosure vector required for targeted exploitation. Where multi-tenant isolation is a hard requirement, migrate to separate databases per tenant rather than relying on record-level access controls within a shared database instance; note this carries significant architectural overhead and may require schema and application refactoring. Full advisory details: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gcwr-5mrf-fvch.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today