SurrealDB Method-Style Function Bypass via Streaming Engine

Executive Summary

CVE-2026-121416 is a capability bypass vulnerability in SurrealDB versions before 3.3.1. It allows authenticated users to execute restricted functions via method-style invocations like [1,2].map() or $f.put()/$f.get() despite --deny-funcs restrictions. The issue occurs because the streaming engine's MethodPart::evaluate function invokes resolved functions without proper capability checks.

Useful 0 Not Useful 0

Detection Guidance

Check SurrealDB version with: surreal version. If version is below 3.3.1, the system is vulnerable. Inspect logs for method-style function calls like [1,2].map() or $f.put()/$f.get(). Monitor for unauthorized file operations despite --deny-funcs settings.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables unauthorized execution of denied functions, potentially allowing attackers to read or write file data, modify records, or perform other restricted operations. Exploitation requires only the ability to submit a query, making it dangerous for deployments using --deny-funcs for hardening.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SurrealDB to version 3.3.1 or later immediately. Review and update --deny-funcs configurations to ensure critical functions like file::* are properly restricted. Audit query logs for signs of exploitation attempts.

Useful 0 Not Useful 0