CVE-2023-54366: SurrealDB insecure default table permissions

CVE-2023-54366 · Severity: high · CVSS 8.8 · Published 2026-07-18

SurrealDB is a distributed document-graph database used as a backend for applications requiring data storage and retrieval. When tables are defined without explicit permissions, the database defaults to granting full access (SELECT, CREATE, UPDATE, DELETE) to all authorized clients. This is particularly dangerous for publicly exposed instances allowing guest access, where unauthenticated remote users could read, modify, or delete any unprotected data stored in tables without explicit permission rules.

Technologies: surrealdb (crates.io). Vendors: crates.io, PyPI.

Quick answers

Is CVE-2023-54366 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-54366 being exploited in the wild.
How severe is CVE-2023-54366?
High severity, with a CVSS score of 8.8, published 18 July 2026.
Which products and versions are affected?
surrealdb (crates.io) < 1.0.1, SEMVER:introduced=0,fixed=1.0.1; surrealdb (PyPI) ECOSYSTEM:introduced=0,fixed=1.0.1.
Is there a fix for CVE-2023-54366?
Yes. surrealdb (crates.io): upgrade to 1.0.1 or later; surrealdb (PyPI): upgrade to 1.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-54366 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-54366?
Check whether you run surrealdb (crates.io) or surrealdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • surrealdb (crates.io): upgrade to 1.0.1 or later
    cargo update -p surrealdb
  • surrealdb (PyPI): upgrade to 1.0.1 or later
    pip install "surrealdb>=1.0.1"

Technical details

SurrealDB had a default permissions vulnerability (CWE-276: Incorrect Default Permissions) where tables created without an explicit PERMISSIONS clause received FULL access for SELECT, CREATE, UPDATE, and DELETE operations instead of restrictive NONE permissions. The vulnerability affects the table definition mechanism itself; any table defined before patching lacks granular access control. Attack vector is network when instances expose HTTP REST API or WebSocket APIs with guest access enabled, allowing unauthenticated or low-privileged users to perform unrestricted CRUD operations on affected tables. Patched versions (1.0.1+, 1.1.0-beta.1+) change default permissions to NONE and ensure INFO FOR DB displays all permissions explicitly. Workarounds for unpatched versions involve explicitly specifying PERMISSIONS NONE or role-based rules during table definition.

Affected products

  • SurrealDB SurrealDB < 1.0.1

Identifiers

  • CVE-2023-54366
  • GHSA-x5fr-7hhj-34j3
  • PYSEC-2026-3718

Timeline

  • 2023-12-15: disclosed
  • 2023-12-15: patched: Version 1.0.1 released with patch; 1.1.0-beta.1 and later also include fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.