CVE-2026-63758
Received Received - Intake

Authorization Bypass in SurrealDB KILL Statement

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions of other users without ownership verification.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63758
EUVD
EUVD-2026-45929

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63758 is an authorization bypass flaw in SurrealDB versions before 3.1.0 affecting the KILL statement. Authenticated users can terminate other users' LIVE SELECT subscriptions by issuing KILL statements with target live query UUIDs without verifying ownership.

Detection Guidance

Monitor for unauthorized KILL statements targeting LIVE SELECT subscriptions. Check SurrealDB logs for KILL commands with UUIDs not owned by the requesting user. Use database monitoring tools to detect live query terminations without proper authorization.

Impact Analysis

This vulnerability allows unauthorized users to disrupt real-time data subscriptions, impacting availability and breaking multi-tenant isolation. Attackers can silently terminate live queries, affecting data streaming and real-time applications.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially violating data availability and integrity requirements. Unauthorized termination of LIVE SELECT subscriptions may disrupt real-time data access, affecting systems handling sensitive personal or health data. Multi-tenant isolation could be compromised, leading to unauthorized access or interference with other users' data streams.

Mitigation Strategies

Upgrade SurrealDB to version 3.1.0 or later to patch the vulnerability. Implement strict access controls to prevent unauthorized KILL statements. Treat live query UUIDs as sensitive information to limit exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63758. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart