Executive brief
SurrealDB is a database platform offering RPC API for authentication and data management. An unauthenticated attacker can exploit insufficient validation in the signin and signup operations to inject database subqueries, allowing unauthorized creation, modification, and deletion of data without proper authorization checks. While direct query results are not visible to the attacker and identity/access control resources remain protected, the attacker gains the ability to manipulate business-critical data under elevated system privileges.
Technical details
The vulnerability is a query injection flaw (CWE-75) in SurrealDB's RPC API signin and signup handlers. During credential validation, arbitrary objects are accepted without recursive validation to detect non-computed values (subqueries). An attacker can craft a binary payload using the bincode serialization format—rather than the default JSON—encoding a SurrealDB subquery in place of credentials. When the signin/signup query (defined by the database owner as part of record access control) is executed, the injected subquery is computed and executed under a system user session with editor role privileges, bypassing authentication. This allows unauthorized CRUD operations on non-IAM data. The attack requires the RPC API to be exposed to untrusted users and a record access method to define SIGNIN or SIGNUP queries. Patches were released in versions 1.5.5 and 2.0.0-beta.3, which now recursively validate objects to ensure they contain no non-computed values.
Affected products
- SurrealDB SurrealDB < 1.5.5, 2.0.0-beta < 2.0.0-beta.3
- SurrealDB surrealdb-core <= 1.5.1
Timeline
- 2024-09-11: disclosed: Advisory GHSA-64f8-pjgr-9wmr published by SurrealDB project
- 2024-09-11: patched: Patches released in versions 1.5.5 and 2.0.0-beta.3
- 2026-07-18: advisory: Duplicate advisory GHSA-xw2c-hrr9-4xwr published to GitHub Advisory Database
- 2026-09-04: other: Duplicate advisory withdrawn on Sep 4, 2026