CVE-2026-109334
Deferred Deferred - Pending Action

SurrealDB Authentication Bypass via Namespace Header

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method to read, create, modify, and delete rows and read DEFINE PARAM values in another tenant where table PERMISSIONS allow it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109334
EUVD
EUVD-2026-97636

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB before version 3.3.0 has a flaw where it does not properly validate the namespace or database selected by a user against their authentication level. This allows an attacker with valid credentials to access or modify data in another tenant's namespace or database if table permissions permit it.

Detection Guidance

To detect this vulnerability, check if your SurrealDB version is below 3.3.0. Use commands like 'surreal version' or inspect the server logs for version information. Monitor HTTP requests for Surreal-NS or Surreal-DB headers and RPC use method calls that access unauthorized namespaces or databases.

Impact Analysis

An authenticated attacker could read, create, modify, or delete rows in another tenant's database or access sensitive DEFINE PARAM values. This could lead to data breaches, unauthorized changes, or service disruption if permissions allow cross-tenant access.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by enabling unauthorized access to sensitive data across tenants. It undermines data isolation and may lead to compliance violations, fines, or reputational damage.

Mitigation Strategies

Upgrade SurrealDB to version 3.3.0 or later to address the cross-tenant access issue. Review and restrict permissions for DEFINE PARAM values and table PERMISSIONS to prevent unauthorized access. Monitor logs for suspicious use of Surreal-NS/Surreal-DB headers or RPC use method calls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109334. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart