Which versions of SurrealDB are affected by EUVD-2026-45927?

SurrealDB before version 3.1.0 contains a critical privilege escalation flaw affecting its primary API endpoint used by all official SDKs, allowing unauthenticated attackers to hijack active user…. A patch is available.

How to fix or mitigate EUVD-2026-45927?

Within 24 hours: Document and inventory all SurrealDB deployments (versions, internet exposure, data sensitivity), and prioritize systems in internet-facing, multi-tenant, or production environments. Within 7 days: Implement compensating controls including network segmentation of /rpc endpoints, WAF rules to detect anomalous request patterns targeting concurrent sessions, and API rate limiting. Within 30 days: Monitor SurrealDB vendor advisories for patch release information, develop an upgrade plan to version 3.1.0 or later once available, and plan immediate patching cycles for systems handling sensitive data; consider evaluation of alternative solutions if patch timeline extends beyond acceptable risk windows.

SurrealDB EUVD-2026-45927

Q: What is the CVSS score of EUVD-2026-45927?

EUVD-2026-45927 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

| CVE-2026-63756 CRITICAL

Race Condition (CWE-362)

2026-07-20 disclosure@vulncheck.com

GHSA-fmh9-9m2w-q5p4

Information Disclosure Race Condition

9.2

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 20, 2026 - 15:33 EUVD

Source Code Evidence Fetched

Jul 20, 2026 - 12:37 vuln.today

Analysis Generated

Jul 20, 2026 - 12:37 vuln.today

CVE Published

Jul 20, 2026 - 12:19 cve.org

CRITICAL 9.2

DescriptionCVE.org

SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated session state. Unauthenticated attackers can send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active to execute operations with hijacked user privileges.

AnalysisAI

Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-active authenticated sessions via a TOCTOU race condition on the HTTP /rpc endpoint — the primary interface used by all official SurrealDB SDKs. Because concurrent requests share mutable authentication state, an unauthenticated request that races in before the state is cleared executes as the authenticated user, potentially escalating to root. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Document and inventory all SurrealDB deployments (versions, internet exposure, data sensitivity), and prioritize systems in internet-facing, multi-tenant, or production environments. …

Threat intelligence, references, and detailed analysis are available after sign-in.