Surrealdb
Monthly
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g. the database editor role) plant futures, functions, or closures inside record fields that later execute in the security context of whoever reads or writes the record. When a root owner or namespace admin touches the poisoned field, the attacker's logic runs with elevated permissions, enabling creation of a root owner and full server takeover. There is no public exploit identified at time of analysis, no KEV listing, and no EPSS score supplied, so risk assessment rests on the vendor advisory and CVSS 4.0 signals rather than observed exploitation.
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single WebSocket message by sending a deeply nested JSON payload to the /rpc endpoint. The value/JSON parser ignores the configured recursion depth limit for nested braces, brackets, and parentheses, so uncontrolled recursion (CWE-674) exhausts server memory and terminates the process. This is an incomplete-fix regression of GHSA-6r8p-hpg7-825g, which patched the same bug class in the expression parser but missed the value/JSON code path; no public exploit identified at time of analysis, though the trigger is trivially reproducible from the advisory.
Denial of service in SurrealDB before 3.1.0 lets an authenticated user with query-execution privileges crash the server with a single WebSocket message. The type/kind parser fails to enforce the configured recursion depth limit when parsing deeply nested type annotations (e.g. array<option<array<option<...>>>>), driving uncontrolled recursion that exhausts server memory and terminates the process. No public exploit identified at time of analysis and not listed in CISA KEV, but the flaw is trivially triggerable and is an incomplete fix of a previously patched bug class (GHSA-6r8p-hpg7-825g).
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the HTTP /rpc 'sessions' method and then impersonate any authenticated session by supplying an arbitrary 'session' field that the /rpc handler never ownership-checks. Because impersonation inherits the victim session's authorization, an anonymous caller can read, write, and delete data and escalate to that session's level, up to root. There is no public exploit identified at time of analysis, but the vendor GHSA advisory documents the mechanism in full detail, making reproduction straightforward.
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-active authenticated sessions via a TOCTOU race condition on the HTTP /rpc endpoint — the primary interface used by all official SurrealDB SDKs. Because concurrent requests share mutable authentication state, an unauthenticated request that races in before the state is cleared executes as the authenticated user, potentially escalating to root. No public exploit is identified at time of analysis, but the flaw is credited by VulnCheck and carries a high CVSS 4.0 score of 9.2.
Broken authorization in SurrealDB before 3.1.0 lets any authenticated principal - including low-privilege Record and Scope users - read the full contents of every table in their current database, bypassing PERMISSIONS FOR SELECT WHERE controls. The flaw stems from the engine evaluating user-supplied WHERE (and SET/MERGE/CONTENT/PATCH) expressions against complete record data before running the table-level SELECT permission check, so side-effecting expressions exfiltrate data the caller should never see. No public exploit identified at time of analysis, and the issue is not in CISA KEV, but the GHSA advisory documents multiple practical exfiltration primitives (scripting functions, THROW, and timing side channels).
Denial of service in SurrealDB before 3.1.0 allows an authenticated user holding only 'select' permission on a table to indefinitely block all CREATE, UPDATE, and DELETE operations on that table for every other user - including root. By registering a LIVE query whose WHERE clause deterministically throws an evaluation error (e.g. calling a typed SurrealQL function with a wrong-typed argument), the resulting error propagates into the write path and rolls back the triggering modification. No public exploit identified at time of analysis, but the technique is fully documented in the vendor's GHSA advisory.
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process with a single WebSocket message to the /rpc endpoint. Sending an RPC 'use' call that sets a database (db) without first selecting a namespace triggers a Rust panic on an .expect() call; because surrealdb-core is compiled with panic = 'abort', the panic aborts the whole process rather than the connection. The vulnerability (CVSS 4.0 8.7, VulnCheck/GHSA-wjjj-24cx-f28g) requires no credentials, token, or --allow-guests flag, and no public exploit has been identified at time of analysis.
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT permissions by traversing graph edges or REFERENCES TO back-references, reading full documents from tables defined with PERMISSIONS FOR select NONE. The root cause is that GraphEdgeScan and ReferenceScan fetched records directly from storage without evaluating the target table's permission expression. No public exploit identified at time of analysis and not listed in CISA KEV; impact is confidentiality-only and bounded to the caller's current database, but any table reachable through a chain of edges from a readable starting point is exposed.
Broken authorization in SurrealDB before 3.1.4 allows record-scoped (authenticated) users to read array elements that field-level SELECT permissions are supposed to hide. When permissions are evaluated against array fields using the `field.*` wildcard, denied elements are leaked back to the caller instead of being filtered out, because the engine mishandles element indexing during permission filtering (CWE-863). No public exploit has been identified at time of analysis and it is not in CISA KEV, but the flaw is a straightforward authorization bypass reachable by any user with record scope access.
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role disclose files readable by the SurrealDB process by pointing the DEFINE ANALYZER mapper() filter at an arbitrary path and harvesting the content from query error messages. The flaw is exploitable in default deployments because the SURREAL_FILE_ALLOWLIST is empty by default and an empty allowlist enforced no restriction. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the GHSA advisory documents the technique in enough detail to reproduce.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire server process with a single crafted query. Submitting a flat operator chain of tens of thousands of terms (e.g. RETURN 1 + 1 + 1 + ...) builds an unbounded expression tree that overflows the thread stack when later walked recursively, aborting the process and denying service to every namespace and database on the instance. No public exploit identified at time of analysis; impact is availability-only with an EPSS-independent CVSS 4.0 score of 7.1.
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belonging to other namespaces and databases by manipulating the scope in the URL path. Because the server fails to validate namespace/database scope on custom API routes, an attacker holding valid credentials for one tenant can read sensitive data or trigger unintended operations in unrelated tenants. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the multi-tenant data-exposure impact is significant (CVSS 4.0 8.6).
Denial of service in SurrealDB's embedded JavaScript scripting engine allows any query-executing user - including unauthenticated guests when guest access is enabled alongside scripting - to immediately crash the server process by passing an oversized string to the QuickJS-NG v0.8 runtime for compilation, triggering a null pointer dereference. The crash requires a manual operator restart with no graceful shutdown, and cannot be leveraged for code execution or data compromise. The attack is constrained to instances where the non-default `--allow-scripting` capability is active; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
SurrealDB before v3.1.0 silently substitutes ES384 (P-384 curve) when operators configure JWT access methods with ALGORITHM ES512 (P-521 curve), because the underlying Rust jsonwebtoken crate v10.x omits an ES512 variant entirely. Operators who provision correct P-521 keys experience authentication handshake failures, and external systems expecting genuine ES512 signatures will reject SurrealDB-issued tokens. No public exploit has been identified at time of analysis; the vendor and GHSA advisory both confirm the flaw cannot be used to forge tokens or compromise confidentiality or integrity, as ES384 itself remains cryptographically strong.
Authorization bypass in SurrealDB's KILL statement before version 3.1.0 allows any authenticated database-level user to silently terminate other users' LIVE SELECT real-time subscriptions by targeting their live query UUIDs, with no ownership verification performed. The affected user receives no notification of termination, breaking real-time data pipelines and multi-tenant isolation guarantees - a low-privilege record-scoped user can disrupt a root user's monitoring subscriptions within the same database. Discovered during a cure53 code audit and penetration test; no public exploit code or CISA KEV listing exists at time of analysis.
LIVE SELECT subscriptions in SurrealDB before 3.1.0 persist real-time change notifications under revoked, expired, or superseded session credentials, violating session boundary enforcement. Authenticated users who register a LIVE SELECT query retain delivery of change notifications after their session is invalidated, expires via TTL, or is replaced by a different identity authenticating on the same WebSocket connection. No public exploit has been identified and no active exploitation is confirmed; vendor-released patch is available in SurrealDB 3.1.0.
Authorization bypass in SurrealDB before 3.1.0 allows authenticated users holding only CREATE permission on an edge table to silently overwrite existing edge records without possessing UPDATE permission. By crafting a RELATE statement with an explicit SET id clause pointing to an already-existing edge id, the storage layer skips the expected conflict check and performs an overwrite instead of returning an error - violating the permission boundary between CREATE and UPDATE operations. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 5.3 reflects the network-reachable but low-privilege, integrity-only impact.
Field-level SELECT permission bypass in SurrealDB before 3.1.0 allows authenticated users to exfiltrate protected field values via a crafted JSON Patch operation. Submitting an UPDATE PATCH with an empty string as the `from` pointer in a `copy` or `move` operation causes the database to duplicate the entire record - including fields restricted by `PERMISSIONS FOR select` - into an attacker-controlled destination field that bypasses the post-query redaction filter. Impact is confidentiality-only and bounded to fields of the single targeted record; no KEV listing and no public exploit code identified at time of analysis, though exploitation requires only a valid authenticated session and standard JSON Patch syntax.
Pre-authentication memory amplification in SurrealDB before 3.1.0 allows unauthenticated network attackers to exhaust server memory by streaming oversized WebSocket frames to the /sql endpoint, which fails to enforce the operator-configured SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit before buffering incoming bytes. The /sql WebSocket upgrade handler accepts anonymous connections and accumulates up to 16 MiB per frame and 64 MiB per reassembled message in per-connection read buffers - the full WebSocket library default - before the authentication check (check_anon) can reject the payload, meaning memory cost is incurred regardless of whether the caller holds any SurrealQL permissions. No public exploit has been identified at time of analysis, but the unauthenticated network-accessible attack surface requires no special prerequisites beyond network connectivity and sustained bandwidth.
Authorization bypass in SurrealDB LIVE SELECT subscriptions allows authenticated record users to receive real-time notifications for records that table-level SELECT permission expressions should have filtered out. Affected versions before 3.1.0 incorrectly evaluate permission expressions against attacker-supplied variable bindings rather than trusted document context when the expression references $value, $before, $after, or $event. No public exploit code has been identified and the issue is not listed in CISA KEV, but the bypass is straightforward for any authenticated subscriber on a vulnerable deployment using the affected variable names in permission logic.
SurrealDB versions before 3.1.0 expose field values protected by field-level SELECT permissions through verbose error messages returned to authenticated users who hold UPDATE access. By issuing UPDATE statements that trigger arithmetic or extend operations against hidden fields - such as adding an integer to a string-typed email field - an attacker receives an error response embedding the raw operand value (e.g., 'Tried to compute "alice@example.com" + 1'). No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the technique is trivially repeatable across any field on any record the attacker holds UPDATE permission on.
Authorization bypass in SurrealDB before 3.1.0 allows authenticated users to circumvent tenant-isolation and object-keyed permission rules by spoofing composite record-id field values through writable body fields. Attackers who can write to any record can set a same-named body field to an arbitrary value; because the permission evaluator incorrectly reads from the editable body rather than the immutable id key, `PERMISSIONS FOR` clauses gating access on `id.<field>` (the common pattern for tenant isolation) are silently defeated. No public exploit has been identified at time of analysis, and the vulnerability requires valid credentials, but the impact includes cross-tenant data exposure and silent UNIQUE constraint corruption. Fix is available in 3.1.0.
Blind SSRF in SurrealDB's JWKS fetcher before 3.1.5 allows Owner-role database principals to bypass network capability controls by chaining an allowlisted host redirect to blocked internal addresses. The JWKS client in `core/src/iam/jwks.rs` applies `check_capabilities_url` only to the originally configured URL, not to 3xx redirect targets, while the hardened `HttpClient` used by `http::*` functions already re-validates each hop since 3.1.0. Exploitation requires Owner-level credentials and yields only blind timing-based probing of internal hosts - no response body is returned - with no public exploit identified at time of analysis.
Server-Side Request Forgery via HTTP redirect in SurrealDB before 3.1.0 allows authenticated users to circumvent port-scoped `--deny-net` network restriction rules. When an `http::*` function call targets an allowed hostname that responds with a 3xx redirect to a denied `host:port`, the redirect policy in `core/src/fnc/util/http/mod.rs` constructs the redirect `NetTarget` from `url.host_str()` alone - silently discarding the port - causing the capability matcher to skip port-specific deny rules entirely. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
SurrealDB before version 3.1.0 leaks restricted field values to authenticated record users by exploiting an indexed COUNT query optimization that skips field-level SELECT permission checks. When a field is protected by DEFINE FIELD ... PERMISSIONS FOR select but is also covered by a DEFINE INDEX, an attacker holding table-level SELECT can confirm or enumerate the field's contents by submitting SELECT count() FROM t WHERE hidden_field = 'guess' GROUP ALL - the query planner's indexed fast path returns a nonzero count for correct guesses without ever evaluating the permission predicate. No public exploit exists and the vulnerability is not in CISA KEV; however, the attack is straightforwardly reconstructable from the detailed vendor advisory.
Unauthenticated namespace and database creation in SurrealDB before 3.1.0 exposes any network-reachable instance to unauthorized catalog manipulation. The RPC use method and SurrealQL executor's USE NS/USE DB handling silently creates namespaces and databases that don't yet exist without verifying whether the caller holds DEFINE NAMESPACE or DEFINE DATABASE authority, making a completely unauthenticated guest session sufficient to pollute or exhaust the catalog. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects limited impact - data within existing namespaces cannot be read or modified - but the storage exhaustion vector and the ability to resurrect deliberately dropped namespaces via stale tokens represent meaningful operational risk for multi-tenant or publicly exposed deployments.
Field-level SELECT permission bypass in SurrealDB 3.1.0-3.1.4 allows authenticated record users to recover field values explicitly hidden by DEFINE FIELD ... PERMISSIONS FOR select NONE by routing queries through graph-edge (`->`) or back-reference (`<~`) traversals rather than direct table scans. The shared `resolve_record_batch` helper used by the 3.1.x query planner's GraphEdgeScan and ReferenceScan paths enforces only table-level authorization, silently skipping the `build_field_state`/`filter_fields_by_permission` routines applied on all other read paths. No public exploit has been identified at time of analysis; vendor-released patch is available in version 3.1.5.
Server-Side Request Forgery in SurrealDB's JWKS fetcher allows an Owner-role attacker to weaponize the server as an internal network proxy. By configuring an access method with a JWKS URL whose hostname passes the string-based allow-list check but resolves via DNS to a private or loopback address, the attacker causes SurrealDB to issue GET requests to internal infrastructure that would otherwise be unreachable. No public exploit has been identified and no CISA KEV listing exists; exploitation is constrained by the requirement for Owner-level privileges, making this a meaningful but bounded risk in privileged-access-compromise scenarios.
Denial of service in SurrealDB's SurrealML header parser allows an authenticated Owner-role user to crash the entire server process by uploading a malformed .surml file to the /ml/import endpoint. Non-numeric input-dimensions or other invalid header fields trigger unchecked Rust unwrap() calls, causing a process-aborting panic that denies service to all databases hosted on the affected instance simultaneously. No public exploit code has been identified at time of analysis; vendor-released patch is available in SurrealDB 3.2.0.
Permissions bypass in SurrealDB before 3.2.0 allows any authenticated user to write to tables they lack explicit access to by embedding data-modifying statements inside PERMISSIONS clauses. Because the database disables enforcement during PERMISSIONS clause evaluation, embedded CREATE, UPDATE, DELETE, or UPSERT statements execute without access control checks, enabling unauthorized writes and data corruption across any table in the instance. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) indicates straightforward network exploitation by any low-privilege authenticated user.
Server-side request forgery in SurrealDB before versions 2.0.5, 2.1.5, and 2.2.2 allows authenticated users to circumvent administrator-configured deny-net network restrictions by exploiting unchecked HTTP redirects in the native http::* query functions. An attacker operates a public HTTP server that issues 301 or 307 redirects to denied internal addresses; SurrealDB follows those redirects without re-validating the destination against the deny-net ACL, and returns the internal response directly to the attacker's query result. No public exploit code has been identified at time of analysis; this issue was discovered by cure53 during a commissioned security audit and penetration test of SurrealDB.
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with OWNER or EDITOR rights define a custom function containing nested FOR loops that bypasses per-loop iteration limits and consumes all server CPU, ignoring configured query timeouts. The multiplicative iteration count (e.g. several nested loops of 1,000,000 each) monopolizes the process until it is manually killed, blocking all other queries and new connections. Discovered during a cure53 audit; no public exploit identified at time of analysis and it is not on CISA KEV, though the technique is trivially reproducible from the advisory.
Resource exhaustion in SurrealDB's embedded JavaScript scripting feature allows authenticated users to deny service by submitting long-running or infinite JavaScript functions that consume server CPU and thread resources without bound. Affected deployments must have explicitly enabled the scripting capability - it is off by default - making this a narrow but real risk in multi-tenant or shared SurrealDB environments where not all authenticated users are fully trusted. No public exploit identified at time of analysis; discovered during a professional code audit and penetration test conducted by cure53, rated Low severity by both cure53 and the vendor.
Denial of service in SurrealDB before 2.2.2 lets an authenticated user crash the database by calling the string::replace function with a regex pattern that produces an unbounded output string, exhausting server memory. The flaw spans the 2.0.x, 2.1.x, and 2.2.x release lines and was discovered during a cure53 security audit; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is availability-only with no confidentiality or integrity loss, rated CVSS 4.0 7.1 High.
Local file read via DEFINE ANALYZER in SurrealDB before versions 2.1.5 and 2.2.2 allows authenticated users holding root, namespace, or database-level privileges to point analyzer mappings at arbitrary server-side file paths, leaking file contents constrained to two-column tab-separated format. Discovered and rated Low severity during a cure53 code audit and penetration test, the flaw is a CWE-22 path traversal with no KEV listing and no public exploit identified at time of analysis. The vendor has released patches for both the 2.1.x and 2.2.x branches and introduced a SURREAL_FILE_ALLOWLIST environment variable to restrict permissible file paths.
Memory exhaustion in SurrealDB's scripting subsystem allows authenticated users to bypass the server's recursion depth limit by chaining native function calls with embedded JavaScript that issues new queries, triggering infinite recursion and depleting server memory. Affected versions span all SurrealDB releases before 2.0.5, 2.1.0-2.1.4, and 2.2.0-2.2.1, but only when the scripting capability is explicitly enabled via a non-default flag. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, any authenticated user on an exposed instance can reliably cause a denial of service.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authenticated OWNER or EDITOR user embed malicious SurrealQL inside unescaped table or field names that executes when a higher-privileged operator re-imports the CLI-exported backup, yielding root-level takeover of the instance. Reported by VulnCheck and discovered during a cure53 audit, it also enables a universal second-order injection against co-tenanted applications that let end users define custom tables or fields, even when query parameters are otherwise sanitized. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor and cure53 both rate the impact Critical (CVSS 4.0 base 9.4).
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted query whose result contains a null byte to the /sql HTTP endpoint. The null byte triggers an uncaught exception during JSON serialization of the query response in the net module, terminating the process and any application that depends on it. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; the reported CVSS 4.0 base score is 7.1 (availability-only impact).
DNS rebinding SSRF bypass in SurrealDB's http::* query functions allows authenticated low-privileged users to reach internal network endpoints that administrators explicitly blocked via the --deny-net flag. The server validates the user-supplied hostname string against the deny list rather than the resolved IP address, so a hostname that resolves to a blocked internal IP passes the check and the outbound request is issued anyway. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the CVSS 4.0 subsequent-system impact is rated High across all three CIA components, reflecting that internal services reached via this SSRF bypass may be completely unauthenticated and expose credentials, metadata, or allow configuration changes.
SurrealDB versions 3.0.0 through 3.1.4 expose a query-planner authorization bypass that allows authenticated record users to infer the relative sort order of field values protected by field-level SELECT permissions. By issuing ORDER BY queries against indexed restricted fields, an attacker with normal table SELECT access can observe that rows are returned in the hidden field's true sorted order even though the field value itself is correctly redacted to null at projection time. No public exploit has been identified at time of analysis, and CISA KEV has not listed this vulnerability; however, the attack surface is inherent to any indexed field protected by field-level permissions in affected versions.
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g. the database editor role) plant futures, functions, or closures inside record fields that later execute in the security context of whoever reads or writes the record. When a root owner or namespace admin touches the poisoned field, the attacker's logic runs with elevated permissions, enabling creation of a root owner and full server takeover. There is no public exploit identified at time of analysis, no KEV listing, and no EPSS score supplied, so risk assessment rests on the vendor advisory and CVSS 4.0 signals rather than observed exploitation.
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single WebSocket message by sending a deeply nested JSON payload to the /rpc endpoint. The value/JSON parser ignores the configured recursion depth limit for nested braces, brackets, and parentheses, so uncontrolled recursion (CWE-674) exhausts server memory and terminates the process. This is an incomplete-fix regression of GHSA-6r8p-hpg7-825g, which patched the same bug class in the expression parser but missed the value/JSON code path; no public exploit identified at time of analysis, though the trigger is trivially reproducible from the advisory.
Denial of service in SurrealDB before 3.1.0 lets an authenticated user with query-execution privileges crash the server with a single WebSocket message. The type/kind parser fails to enforce the configured recursion depth limit when parsing deeply nested type annotations (e.g. array<option<array<option<...>>>>), driving uncontrolled recursion that exhausts server memory and terminates the process. No public exploit identified at time of analysis and not listed in CISA KEV, but the flaw is trivially triggerable and is an incomplete fix of a previously patched bug class (GHSA-6r8p-hpg7-825g).
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the HTTP /rpc 'sessions' method and then impersonate any authenticated session by supplying an arbitrary 'session' field that the /rpc handler never ownership-checks. Because impersonation inherits the victim session's authorization, an anonymous caller can read, write, and delete data and escalate to that session's level, up to root. There is no public exploit identified at time of analysis, but the vendor GHSA advisory documents the mechanism in full detail, making reproduction straightforward.
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-active authenticated sessions via a TOCTOU race condition on the HTTP /rpc endpoint — the primary interface used by all official SurrealDB SDKs. Because concurrent requests share mutable authentication state, an unauthenticated request that races in before the state is cleared executes as the authenticated user, potentially escalating to root. No public exploit is identified at time of analysis, but the flaw is credited by VulnCheck and carries a high CVSS 4.0 score of 9.2.
Broken authorization in SurrealDB before 3.1.0 lets any authenticated principal - including low-privilege Record and Scope users - read the full contents of every table in their current database, bypassing PERMISSIONS FOR SELECT WHERE controls. The flaw stems from the engine evaluating user-supplied WHERE (and SET/MERGE/CONTENT/PATCH) expressions against complete record data before running the table-level SELECT permission check, so side-effecting expressions exfiltrate data the caller should never see. No public exploit identified at time of analysis, and the issue is not in CISA KEV, but the GHSA advisory documents multiple practical exfiltration primitives (scripting functions, THROW, and timing side channels).
Denial of service in SurrealDB before 3.1.0 allows an authenticated user holding only 'select' permission on a table to indefinitely block all CREATE, UPDATE, and DELETE operations on that table for every other user - including root. By registering a LIVE query whose WHERE clause deterministically throws an evaluation error (e.g. calling a typed SurrealQL function with a wrong-typed argument), the resulting error propagates into the write path and rolls back the triggering modification. No public exploit identified at time of analysis, but the technique is fully documented in the vendor's GHSA advisory.
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process with a single WebSocket message to the /rpc endpoint. Sending an RPC 'use' call that sets a database (db) without first selecting a namespace triggers a Rust panic on an .expect() call; because surrealdb-core is compiled with panic = 'abort', the panic aborts the whole process rather than the connection. The vulnerability (CVSS 4.0 8.7, VulnCheck/GHSA-wjjj-24cx-f28g) requires no credentials, token, or --allow-guests flag, and no public exploit has been identified at time of analysis.
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT permissions by traversing graph edges or REFERENCES TO back-references, reading full documents from tables defined with PERMISSIONS FOR select NONE. The root cause is that GraphEdgeScan and ReferenceScan fetched records directly from storage without evaluating the target table's permission expression. No public exploit identified at time of analysis and not listed in CISA KEV; impact is confidentiality-only and bounded to the caller's current database, but any table reachable through a chain of edges from a readable starting point is exposed.
Broken authorization in SurrealDB before 3.1.4 allows record-scoped (authenticated) users to read array elements that field-level SELECT permissions are supposed to hide. When permissions are evaluated against array fields using the `field.*` wildcard, denied elements are leaked back to the caller instead of being filtered out, because the engine mishandles element indexing during permission filtering (CWE-863). No public exploit has been identified at time of analysis and it is not in CISA KEV, but the flaw is a straightforward authorization bypass reachable by any user with record scope access.
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role disclose files readable by the SurrealDB process by pointing the DEFINE ANALYZER mapper() filter at an arbitrary path and harvesting the content from query error messages. The flaw is exploitable in default deployments because the SURREAL_FILE_ALLOWLIST is empty by default and an empty allowlist enforced no restriction. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the GHSA advisory documents the technique in enough detail to reproduce.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire server process with a single crafted query. Submitting a flat operator chain of tens of thousands of terms (e.g. RETURN 1 + 1 + 1 + ...) builds an unbounded expression tree that overflows the thread stack when later walked recursively, aborting the process and denying service to every namespace and database on the instance. No public exploit identified at time of analysis; impact is availability-only with an EPSS-independent CVSS 4.0 score of 7.1.
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belonging to other namespaces and databases by manipulating the scope in the URL path. Because the server fails to validate namespace/database scope on custom API routes, an attacker holding valid credentials for one tenant can read sensitive data or trigger unintended operations in unrelated tenants. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the multi-tenant data-exposure impact is significant (CVSS 4.0 8.6).
Denial of service in SurrealDB's embedded JavaScript scripting engine allows any query-executing user - including unauthenticated guests when guest access is enabled alongside scripting - to immediately crash the server process by passing an oversized string to the QuickJS-NG v0.8 runtime for compilation, triggering a null pointer dereference. The crash requires a manual operator restart with no graceful shutdown, and cannot be leveraged for code execution or data compromise. The attack is constrained to instances where the non-default `--allow-scripting` capability is active; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
SurrealDB before v3.1.0 silently substitutes ES384 (P-384 curve) when operators configure JWT access methods with ALGORITHM ES512 (P-521 curve), because the underlying Rust jsonwebtoken crate v10.x omits an ES512 variant entirely. Operators who provision correct P-521 keys experience authentication handshake failures, and external systems expecting genuine ES512 signatures will reject SurrealDB-issued tokens. No public exploit has been identified at time of analysis; the vendor and GHSA advisory both confirm the flaw cannot be used to forge tokens or compromise confidentiality or integrity, as ES384 itself remains cryptographically strong.
Authorization bypass in SurrealDB's KILL statement before version 3.1.0 allows any authenticated database-level user to silently terminate other users' LIVE SELECT real-time subscriptions by targeting their live query UUIDs, with no ownership verification performed. The affected user receives no notification of termination, breaking real-time data pipelines and multi-tenant isolation guarantees - a low-privilege record-scoped user can disrupt a root user's monitoring subscriptions within the same database. Discovered during a cure53 code audit and penetration test; no public exploit code or CISA KEV listing exists at time of analysis.
LIVE SELECT subscriptions in SurrealDB before 3.1.0 persist real-time change notifications under revoked, expired, or superseded session credentials, violating session boundary enforcement. Authenticated users who register a LIVE SELECT query retain delivery of change notifications after their session is invalidated, expires via TTL, or is replaced by a different identity authenticating on the same WebSocket connection. No public exploit has been identified and no active exploitation is confirmed; vendor-released patch is available in SurrealDB 3.1.0.
Authorization bypass in SurrealDB before 3.1.0 allows authenticated users holding only CREATE permission on an edge table to silently overwrite existing edge records without possessing UPDATE permission. By crafting a RELATE statement with an explicit SET id clause pointing to an already-existing edge id, the storage layer skips the expected conflict check and performs an overwrite instead of returning an error - violating the permission boundary between CREATE and UPDATE operations. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 5.3 reflects the network-reachable but low-privilege, integrity-only impact.
Field-level SELECT permission bypass in SurrealDB before 3.1.0 allows authenticated users to exfiltrate protected field values via a crafted JSON Patch operation. Submitting an UPDATE PATCH with an empty string as the `from` pointer in a `copy` or `move` operation causes the database to duplicate the entire record - including fields restricted by `PERMISSIONS FOR select` - into an attacker-controlled destination field that bypasses the post-query redaction filter. Impact is confidentiality-only and bounded to fields of the single targeted record; no KEV listing and no public exploit code identified at time of analysis, though exploitation requires only a valid authenticated session and standard JSON Patch syntax.
Pre-authentication memory amplification in SurrealDB before 3.1.0 allows unauthenticated network attackers to exhaust server memory by streaming oversized WebSocket frames to the /sql endpoint, which fails to enforce the operator-configured SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit before buffering incoming bytes. The /sql WebSocket upgrade handler accepts anonymous connections and accumulates up to 16 MiB per frame and 64 MiB per reassembled message in per-connection read buffers - the full WebSocket library default - before the authentication check (check_anon) can reject the payload, meaning memory cost is incurred regardless of whether the caller holds any SurrealQL permissions. No public exploit has been identified at time of analysis, but the unauthenticated network-accessible attack surface requires no special prerequisites beyond network connectivity and sustained bandwidth.
Authorization bypass in SurrealDB LIVE SELECT subscriptions allows authenticated record users to receive real-time notifications for records that table-level SELECT permission expressions should have filtered out. Affected versions before 3.1.0 incorrectly evaluate permission expressions against attacker-supplied variable bindings rather than trusted document context when the expression references $value, $before, $after, or $event. No public exploit code has been identified and the issue is not listed in CISA KEV, but the bypass is straightforward for any authenticated subscriber on a vulnerable deployment using the affected variable names in permission logic.
SurrealDB versions before 3.1.0 expose field values protected by field-level SELECT permissions through verbose error messages returned to authenticated users who hold UPDATE access. By issuing UPDATE statements that trigger arithmetic or extend operations against hidden fields - such as adding an integer to a string-typed email field - an attacker receives an error response embedding the raw operand value (e.g., 'Tried to compute "alice@example.com" + 1'). No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the technique is trivially repeatable across any field on any record the attacker holds UPDATE permission on.
Authorization bypass in SurrealDB before 3.1.0 allows authenticated users to circumvent tenant-isolation and object-keyed permission rules by spoofing composite record-id field values through writable body fields. Attackers who can write to any record can set a same-named body field to an arbitrary value; because the permission evaluator incorrectly reads from the editable body rather than the immutable id key, `PERMISSIONS FOR` clauses gating access on `id.<field>` (the common pattern for tenant isolation) are silently defeated. No public exploit has been identified at time of analysis, and the vulnerability requires valid credentials, but the impact includes cross-tenant data exposure and silent UNIQUE constraint corruption. Fix is available in 3.1.0.
Blind SSRF in SurrealDB's JWKS fetcher before 3.1.5 allows Owner-role database principals to bypass network capability controls by chaining an allowlisted host redirect to blocked internal addresses. The JWKS client in `core/src/iam/jwks.rs` applies `check_capabilities_url` only to the originally configured URL, not to 3xx redirect targets, while the hardened `HttpClient` used by `http::*` functions already re-validates each hop since 3.1.0. Exploitation requires Owner-level credentials and yields only blind timing-based probing of internal hosts - no response body is returned - with no public exploit identified at time of analysis.
Server-Side Request Forgery via HTTP redirect in SurrealDB before 3.1.0 allows authenticated users to circumvent port-scoped `--deny-net` network restriction rules. When an `http::*` function call targets an allowed hostname that responds with a 3xx redirect to a denied `host:port`, the redirect policy in `core/src/fnc/util/http/mod.rs` constructs the redirect `NetTarget` from `url.host_str()` alone - silently discarding the port - causing the capability matcher to skip port-specific deny rules entirely. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
SurrealDB before version 3.1.0 leaks restricted field values to authenticated record users by exploiting an indexed COUNT query optimization that skips field-level SELECT permission checks. When a field is protected by DEFINE FIELD ... PERMISSIONS FOR select but is also covered by a DEFINE INDEX, an attacker holding table-level SELECT can confirm or enumerate the field's contents by submitting SELECT count() FROM t WHERE hidden_field = 'guess' GROUP ALL - the query planner's indexed fast path returns a nonzero count for correct guesses without ever evaluating the permission predicate. No public exploit exists and the vulnerability is not in CISA KEV; however, the attack is straightforwardly reconstructable from the detailed vendor advisory.
Unauthenticated namespace and database creation in SurrealDB before 3.1.0 exposes any network-reachable instance to unauthorized catalog manipulation. The RPC use method and SurrealQL executor's USE NS/USE DB handling silently creates namespaces and databases that don't yet exist without verifying whether the caller holds DEFINE NAMESPACE or DEFINE DATABASE authority, making a completely unauthenticated guest session sufficient to pollute or exhaust the catalog. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects limited impact - data within existing namespaces cannot be read or modified - but the storage exhaustion vector and the ability to resurrect deliberately dropped namespaces via stale tokens represent meaningful operational risk for multi-tenant or publicly exposed deployments.
Field-level SELECT permission bypass in SurrealDB 3.1.0-3.1.4 allows authenticated record users to recover field values explicitly hidden by DEFINE FIELD ... PERMISSIONS FOR select NONE by routing queries through graph-edge (`->`) or back-reference (`<~`) traversals rather than direct table scans. The shared `resolve_record_batch` helper used by the 3.1.x query planner's GraphEdgeScan and ReferenceScan paths enforces only table-level authorization, silently skipping the `build_field_state`/`filter_fields_by_permission` routines applied on all other read paths. No public exploit has been identified at time of analysis; vendor-released patch is available in version 3.1.5.
Server-Side Request Forgery in SurrealDB's JWKS fetcher allows an Owner-role attacker to weaponize the server as an internal network proxy. By configuring an access method with a JWKS URL whose hostname passes the string-based allow-list check but resolves via DNS to a private or loopback address, the attacker causes SurrealDB to issue GET requests to internal infrastructure that would otherwise be unreachable. No public exploit has been identified and no CISA KEV listing exists; exploitation is constrained by the requirement for Owner-level privileges, making this a meaningful but bounded risk in privileged-access-compromise scenarios.
Denial of service in SurrealDB's SurrealML header parser allows an authenticated Owner-role user to crash the entire server process by uploading a malformed .surml file to the /ml/import endpoint. Non-numeric input-dimensions or other invalid header fields trigger unchecked Rust unwrap() calls, causing a process-aborting panic that denies service to all databases hosted on the affected instance simultaneously. No public exploit code has been identified at time of analysis; vendor-released patch is available in SurrealDB 3.2.0.
Permissions bypass in SurrealDB before 3.2.0 allows any authenticated user to write to tables they lack explicit access to by embedding data-modifying statements inside PERMISSIONS clauses. Because the database disables enforcement during PERMISSIONS clause evaluation, embedded CREATE, UPDATE, DELETE, or UPSERT statements execute without access control checks, enabling unauthorized writes and data corruption across any table in the instance. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) indicates straightforward network exploitation by any low-privilege authenticated user.
Server-side request forgery in SurrealDB before versions 2.0.5, 2.1.5, and 2.2.2 allows authenticated users to circumvent administrator-configured deny-net network restrictions by exploiting unchecked HTTP redirects in the native http::* query functions. An attacker operates a public HTTP server that issues 301 or 307 redirects to denied internal addresses; SurrealDB follows those redirects without re-validating the destination against the deny-net ACL, and returns the internal response directly to the attacker's query result. No public exploit code has been identified at time of analysis; this issue was discovered by cure53 during a commissioned security audit and penetration test of SurrealDB.
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with OWNER or EDITOR rights define a custom function containing nested FOR loops that bypasses per-loop iteration limits and consumes all server CPU, ignoring configured query timeouts. The multiplicative iteration count (e.g. several nested loops of 1,000,000 each) monopolizes the process until it is manually killed, blocking all other queries and new connections. Discovered during a cure53 audit; no public exploit identified at time of analysis and it is not on CISA KEV, though the technique is trivially reproducible from the advisory.
Resource exhaustion in SurrealDB's embedded JavaScript scripting feature allows authenticated users to deny service by submitting long-running or infinite JavaScript functions that consume server CPU and thread resources without bound. Affected deployments must have explicitly enabled the scripting capability - it is off by default - making this a narrow but real risk in multi-tenant or shared SurrealDB environments where not all authenticated users are fully trusted. No public exploit identified at time of analysis; discovered during a professional code audit and penetration test conducted by cure53, rated Low severity by both cure53 and the vendor.
Denial of service in SurrealDB before 2.2.2 lets an authenticated user crash the database by calling the string::replace function with a regex pattern that produces an unbounded output string, exhausting server memory. The flaw spans the 2.0.x, 2.1.x, and 2.2.x release lines and was discovered during a cure53 security audit; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is availability-only with no confidentiality or integrity loss, rated CVSS 4.0 7.1 High.
Local file read via DEFINE ANALYZER in SurrealDB before versions 2.1.5 and 2.2.2 allows authenticated users holding root, namespace, or database-level privileges to point analyzer mappings at arbitrary server-side file paths, leaking file contents constrained to two-column tab-separated format. Discovered and rated Low severity during a cure53 code audit and penetration test, the flaw is a CWE-22 path traversal with no KEV listing and no public exploit identified at time of analysis. The vendor has released patches for both the 2.1.x and 2.2.x branches and introduced a SURREAL_FILE_ALLOWLIST environment variable to restrict permissible file paths.
Memory exhaustion in SurrealDB's scripting subsystem allows authenticated users to bypass the server's recursion depth limit by chaining native function calls with embedded JavaScript that issues new queries, triggering infinite recursion and depleting server memory. Affected versions span all SurrealDB releases before 2.0.5, 2.1.0-2.1.4, and 2.2.0-2.2.1, but only when the scripting capability is explicitly enabled via a non-default flag. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, any authenticated user on an exposed instance can reliably cause a denial of service.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authenticated OWNER or EDITOR user embed malicious SurrealQL inside unescaped table or field names that executes when a higher-privileged operator re-imports the CLI-exported backup, yielding root-level takeover of the instance. Reported by VulnCheck and discovered during a cure53 audit, it also enables a universal second-order injection against co-tenanted applications that let end users define custom tables or fields, even when query parameters are otherwise sanitized. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor and cure53 both rate the impact Critical (CVSS 4.0 base 9.4).
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted query whose result contains a null byte to the /sql HTTP endpoint. The null byte triggers an uncaught exception during JSON serialization of the query response in the net module, terminating the process and any application that depends on it. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; the reported CVSS 4.0 base score is 7.1 (availability-only impact).
DNS rebinding SSRF bypass in SurrealDB's http::* query functions allows authenticated low-privileged users to reach internal network endpoints that administrators explicitly blocked via the --deny-net flag. The server validates the user-supplied hostname string against the deny list rather than the resolved IP address, so a hostname that resolves to a blocked internal IP passes the check and the outbound request is issued anyway. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the CVSS 4.0 subsequent-system impact is rated High across all three CIA components, reflecting that internal services reached via this SSRF bypass may be completely unauthenticated and expose credentials, metadata, or allow configuration changes.
SurrealDB versions 3.0.0 through 3.1.4 expose a query-planner authorization bypass that allows authenticated record users to infer the relative sort order of field values protected by field-level SELECT permissions. By issuing ORDER BY queries against indexed restricted fields, an attacker with normal table SELECT access can observe that rows are returned in the hidden field's true sorted order even though the field value itself is correctly redacted to null at projection time. No public exploit has been identified at time of analysis, and CISA KEV has not listed this vulnerability; however, the attack surface is inherent to any indexed field protected by field-level permissions in affected versions.