SurrealDB security advisories

54 advisories across SurrealDB

Date	Advisory	Severity	Fixed in
Sep 4	SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path High8.1Sep 4 CVE-2026-637353.2.0	High8.1	3.2.0
Aug 14	SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users Medium6.5Aug 14 CVE-2026-637403.1.4	Medium6.5	3.1.4
Jul 1	SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted Medium5.4Jul 1 CVE-2026-499973.1.0	Medium5.4	3.1.0
Jul 1	SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation Medium4.3Jul 1 CVE-2026-637613.1.0	Medium4.3	3.1.0
Jul 1	SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths Medium4.3Jul 1 GHSA-c8jx-96c9-8xrp3.1.0	Medium4.3	3.1.0
Jul 1	SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization Medium6.5Jul 1 GHSA-wp87-mgvq-5j933.1.0	Medium6.5	3.1.0
Jul 1	SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect Medium6.4Jul 1 CVE-2026-637433.1.0	Medium6.4	3.1.0
Jul 1	SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions Medium4.3Jul 1 GHSA-6wqw-vhfr-99993.1.0	Medium4.3	3.1.0
Jul 1	SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission Medium4.3Jul 1 GHSA-f82j-v89j-mf863.1.0	Medium4.3	3.1.0
Jul 1	SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from` Medium4.3Jul 1 CVE-2026-637513.1.0	Medium4.3	3.1.0
Jul 1	SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages Medium4.3Jul 1 CVE-2026-637483.1.0	Medium4.3	3.1.0
Jul 1	SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controls Medium4.3Jul 1 GHSA-4m82-p8cx-f94j3.1.0	Medium4.3	3.1.0
Jul 1	SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames Medium5.3Jul 1 GHSA-65rj-r9fh-jp2v3.1.0	Medium5.3	3.1.0
Jul 1	SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries Medium5.4Jul 1 CVE-2026-637583.1.0	Medium5.4	3.1.0
Jul 1	SurrealDB: unchecked exceptional condition Medium6.5Jul 1 GHSA-4v76-cw68-4vc93.1.0	Medium6.5	3.1.0
Jul 1	SurrealDB has an Authorization Bypass via Composite Record-id Paths Medium5.4Jul 1 GHSA-6vg3-hgrw-p5gf3.1.0	Medium5.4	3.1.0
Jul 1	SurrealDB: Graph traversal bypasses table SELECT permissions Medium6.5Jul 1 CVE-2026-637463.1.0	Medium6.5	3.1.0
Jul 1	SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level Medium6.5Jul 1 CVE-2026-637553.1.0	Medium6.5	3.1.0
Jul 1	SurrealDB vulnerable to Denial of Service due to nested types annotations Medium6.5Jul 1 GHSA-q8qp-67f9-wr3f3.1.0	Medium6.5	3.1.0
Jul 1	SurrealDB has unauthenticated remote DoS via malformed RPC `use` call High7.5Jul 1 GHSA-wjjj-24cx-f28g3.1.0	High7.5	3.1.0
Jul 1	SurrealDB has Denial of Service in JSON parser due to nested objects High7.5Jul 1 CVE-2026-637603.1.0	High7.5	3.1.0
Jul 1	SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation High8.1Jul 1 GHSA-4vgr-h27g-cf9p3.1.0	High8.1	3.1.0
Jul 1	SurrealDB: session fixation High8.8Jul 1 GHSA-5qfp-32cf-69jh3.1.0	High8.8	3.1.0
Jun 19	SurrealDB: Denial of Service via deep operator chains Medium6.5Jun 19 GHSA-jv2j-mqmw-xvv53.1.5	Medium6.5	3.1.5
Jun 19	SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals Medium4.3Jun 19 CVE-2026-637383.1.5	Medium4.3	3.1.5
Jun 19	SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field Medium4.3Jun 19 GHSA-h4h3-3rfj-x6fq3.1.5	Medium4.3	3.1.5
Jun 19	SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter High7.7Jun 19 GHSA-cc8f-fcx3-gpjr3.1.5	High7.7	3.1.5
Jun 19	SurrealDB: SSRF via JWKS URL , Redirect Following in JWT Key Fetch Medium4.1Jun 19 GHSA-h5rg-8p7f-47g23.1.5	Medium4.1	3.1.5
Feb 12	SurrealDB vulnerable to Denial of Service through scripting function memory edge case MediumFeb 12 CVE-2026-637622.6.1+1 more	Medium	2.6.1+1 more
Jan 22	SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions HighJan 22 CVE-2026-637632.5.0+1 more	High	2.5.0+1 more
Apr 112025	SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF) MediumApr 11, 2025 CVE-2025-713982.0.5+2 more	Medium	2.0.5+2 more
Apr 112025	SurrealDB CPU exhaustion via custom functions result in total DoS HighApr 11, 2025 CVE-2025-713972.0.5+2 more	High	2.0.5+2 more
Apr 112025	SurrealDB no JavaScript script function default timeout could facilitate DoS LowApr 11, 2025 CVE-2025-713962.0.5+2 more	Low	2.0.5+2 more
Apr 112025	SurrealDB memory exhaustion via string::replace using regex HighApr 11, 2025 CVE-2025-713952.0.5+2 more	High	2.0.5+2 more
Apr 112025	SurrealDB server-takeover via SurrealQL injection on backup import CriticalApr 11, 2025 CVE-2025-713922.0.5+2 more	Critical	2.0.5+2 more
Apr 102025	SurrealDB has local file read of 2-column TSV files via analyzers LowApr 10, 2025 CVE-2025-713942.1.5+1 more	Low	2.1.5+1 more
Apr 102025	SurrealDB vulnerable to memory exhaustion via nested functions and scripts MediumApr 10, 2025 CVE-2025-713932.0.5+2 more	Medium	2.0.5+2 more
Apr 102025	SurrealDB has uncaught exception in Net module that leads to database crash HighApr 10, 2025 CVE-2025-713912.0.5+2 more	High	2.0.5+2 more
Dec 162024	SurrealDB has Silent Failure to Overwrite Table Definition of Relation Type LowDec 16, 2024 CVE-2024-583562.1.4	Low	2.1.4
Nov 222024	SurrealDB has an Uncaught Exception Sorting Tables by Random Order Medium6.5Nov 22, 2024 CVE-2024-583592.1.0	Medium6.5	2.1.0
Nov 222024	SurrealDB has an Uncaught Exception Handling Nonexistent Role Medium4.9Nov 22, 2024 CVE-2024-583582.1.0	Medium4.9	2.1.0
Nov 222024	SurrealDB has an Uncaught Exception in Function Generating Random Time Medium6.5Nov 22, 2024 CVE-2024-583572.1.0	Medium6.5	2.1.0
Oct 82024	SurrealDB: Improper Authorization in Select Permissions High6.5Oct 8, 2024 CVE-2024-583672.0.4	High6.5	2.0.4
Oct 82024	SurrealDB has an Uncaught Exception Handling Parsing Errors on Empty Strings High6.5Oct 8, 2024 CVE-2024-583612.0.4	High6.5	2.0.4
Sep 112024	Untrusted Query Object Evaluation in RPC API High8.8Sep 11, 2024 CVE-2024-583621.5.5+1 more	High8.8	1.5.5+1 more
Jul 112024	SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User Medium6.3Jul 11, 2024 CVE-2024-583631.5.4+1 more	Medium6.3	1.5.4+1 more
Feb 212024	Externally Controlled Format String in Scripting Functions High8.5Feb 21, 2024 CVE-2024-583661.1.1	High8.5	1.1.1
Feb 212024	Uncaught Exception in Macro Expecting Native Function to Exist Medium6.5Feb 21, 2024 CVE-2024-583651.2.0	Medium6.5	1.2.0
Feb 212024	Uncaught Exception Handling Parsing Errors on Line Terminators Medium6.5Feb 21, 2024 CVE-2024-583641.2.1	Medium6.5	1.2.1
Jan 192024	SurrealDB vulnerable to Uncontrolled CPU Consumption via WebSocket Interface High7.5Jan 19, 2024 GHSA-58j9-j2fj-v8f41.1.0	High7.5	1.1.0
Jan 182024	Uncontrolled Recursion in SurrealQL Parsing Medium6.5Jan 18, 2024 CVE-2024-583701.1.0	Medium6.5	1.1.0
Jan 182024	Uncaught Exception processing HTTP Headers in SurrealDB High7.5Jan 18, 2024 CVE-2024-583681.1.0	High7.5	1.1.0
Jan 182024	Uncaught Exception in surrealdb Medium6.5Jan 18, 2024 CVE-2024-583691.1.1	Medium6.5	1.1.1
Dec 152023	SurrealDB: Full Table Permissions by Default High8.8Dec 15, 2023 CVE-2023-543661.0.1	High8.8	1.0.1

Critical advisories by email