CVE-2024-58362: SurrealDB query injection in RPC API signin and signup operations

CVE-2024-58362 · Severity: high · CVSS 8.8 · Published 2026-07-18

SurrealDB is a database platform offering RPC API for authentication and data management. An unauthenticated attacker can exploit insufficient validation in the signin and signup operations to inject database subqueries, allowing unauthorized creation, modification, and deletion of data without proper authorization checks. While direct query results are not visible to the attacker and identity/access control resources remain protected, the attacker gains the ability to manipulate business-critical data under elevated system privileges.

Technologies: surrealdb (crates.io), surrealdb-core (crates.io), Surrealdb-Core. Vendors: crates.io, SurrealDB.

Quick answers

Is CVE-2024-58362 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-58362 being exploited in the wild.
How severe is CVE-2024-58362?
High severity, with a CVSS score of 8.8, published 18 July 2026.
Which products and versions are affected?
surrealdb (crates.io) < 1.5.5, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.5.5; surrealdb-core (crates.io) SEMVER:introduced=0,fixed=1.5.2; Surrealdb-Core < 1.5.2, <= 1.5.1.
Is there a fix for CVE-2024-58362?
Yes. surrealdb (crates.io): upgrade to 1.5.5 or later; surrealdb-core (crates.io): upgrade to 1.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-58362 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2024-58362?
Check whether you run surrealdb (crates.io), surrealdb-core (crates.io) or Surrealdb-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • surrealdb (crates.io): upgrade to 1.5.5 or later
    cargo update -p surrealdb
  • surrealdb-core (crates.io): upgrade to 1.5.2 or later
    cargo update -p surrealdb-core

Technical details

The vulnerability is a query injection flaw (CWE-75) in SurrealDB's RPC API signin and signup handlers. During credential validation, arbitrary objects are accepted without recursive validation to detect non-computed values (subqueries). An attacker can craft a binary payload using the bincode serialization format—rather than the default JSON—encoding a SurrealDB subquery in place of credentials. When the signin/signup query (defined by the database owner as part of record access control) is executed, the injected subquery is computed and executed under a system user session with editor role privileges, bypassing authentication. This allows unauthorized CRUD operations on non-IAM data. The attack requires the RPC API to be exposed to untrusted users and a record access method to define SIGNIN or SIGNUP queries. Patches were released in versions 1.5.5 and 2.0.0-beta.3, which now recursively validate objects to ensure they contain no non-computed values.

Affected products

  • SurrealDB SurrealDB < 1.5.5, 2.0.0-beta < 2.0.0-beta.3
  • SurrealDB surrealdb-core <= 1.5.1

Identifiers

  • CVE-2024-58362
  • GHSA-64f8-pjgr-9wmr
  • GHSA-xw2c-hrr9-4xwr

Timeline

  • 2024-09-11: disclosed: Advisory GHSA-64f8-pjgr-9wmr published by SurrealDB project
  • 2024-09-11: patched: Patches released in versions 1.5.5 and 2.0.0-beta.3
  • 2026-07-18: advisory: Duplicate advisory GHSA-xw2c-hrr9-4xwr published to GitHub Advisory Database
  • 2026-09-04: other: Duplicate advisory withdrawn on Sep 4, 2026

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.