CVE-2026-109343
Deferred Deferred - Pending Action

Cross-Tenant Access in SurrealDB Prior to 3.3.0

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch to another tenant and read, create, update, or delete rows in tables whose PERMISSIONS allow it, such as PERMISSIONS FULL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109343
EUVD
EUVD-2026-97645

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB before version 3.3.0 has a vulnerability where the SurrealQL USE statement allows switching to any namespace or database without verifying if the user's authentication level permits it. This enables authenticated users to access other tenants' data if table permissions allow it.

Detection Guidance

Detecting this vulnerability requires checking SurrealDB versions and reviewing database permissions. Use commands like 'surreal version' to verify if your SurrealDB version is below 3.3.0. Inspect PERMISSIONS settings in your database schema to identify tables with FULL permissions that could allow unauthorized tenant access.

Impact Analysis

An attacker with authenticated access could switch to another tenant's namespace/database and read, modify, or delete data in tables with PERMISSIONS FULL. This could lead to unauthorized data access, data corruption, or data loss across tenants.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by allowing unauthorized access to sensitive data. It undermines tenant isolation, potentially leading to data breaches and non-compliance with privacy requirements.

Mitigation Strategies

Upgrade SurrealDB to version 3.3.0 or later immediately. Review and restrict PERMISSIONS settings to ensure authenticated users cannot switch to unauthorized namespaces or databases. Implement strict access controls and audit existing permissions to prevent cross-tenant access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109343. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart