CVE-2026-63756
Received Received - Intake

SurrealDB HTTP /rpc Race Condition Allows Privilege Escalation

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated session state. Unauthenticated attackers can send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active to execute operations with hijacked user privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63756
EUVD
EUVD-2026-45927

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63756 is a race condition vulnerability in SurrealDB versions before 3.1.0. It affects the HTTP /rpc endpoint where unauthenticated requests can inherit the privileges of an authenticated session if they are processed concurrently. This happens because the endpoint does not isolate session contexts per request, allowing attackers to execute operations with hijacked user privileges without needing credentials.

Detection Guidance

Monitor HTTP traffic to the /rpc endpoint for concurrent unauthenticated and authenticated requests. Check SurrealDB logs for unusual privilege escalation events or unauthorized operations. Use network monitoring tools to detect repeated rapid requests to the /rpc endpoint during active sessions.

Impact Analysis

If exploited, this vulnerability allows unauthenticated attackers to gain unauthorized access to sensitive data, modify or delete records, or perform actions with the privileges of the hijacked user. The impact depends on the compromised session's permissions, ranging from full database access to limited scoped operations. No credentials or prior access are required, only the ability to send concurrent requests to the /rpc endpoint during active authenticated sessions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements under GDPR and HIPAA. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Exploitation may result in non-compliance, potential fines, and reputational damage due to unauthorized data exposure or tampering.

Mitigation Strategies

Upgrade SurrealDB to version 3.1.0 or later immediately. Restrict network access to the /rpc endpoint using firewalls or network segmentation. Implement rate limiting on the /rpc endpoint to reduce the chance of race conditions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63756. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart