CVE-2026-109333: SurrealDB authorization bypass in FETCH query resolution

CVE-2026-109333 · Severity: medium · CVSS 6.5 · Published 2026-10-12

SurrealDB is a database engine used to store and query application data. In versions 3.0.0 through 3.2.x, an authenticated user with limited access to one database could exploit a weakness in record retrieval to read records belonging to other tenants on the same instance, potentially exposing sensitive data from other customers. An attacker must already have valid credentials and must know the specific record identifier to target.

Technologies: Surrealdb. Vendors: SurrealDB.

Quick answers

Is CVE-2026-109333 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-109333 being exploited in the wild.
How severe is CVE-2026-109333?
Medium severity, with a CVSS score of 6.5, published 12 October 2026.
Which products and versions are affected?
Surrealdb 3.0.0 to 3.2.x.
Is there a fix for CVE-2026-109333?
Yes: fixed in 3.3.0. Until then: Until patched, on shared instances use separate SurrealDB deployments rather than namespace/database boundaries to isolate tenants. Issue namespace, database, and record-level credentials only to parties trusted with all tenants on the instance. Prefer PERMISSIONS WHERE clauses that check caller identity over PERMISSIONS FULL, though this reduces but does not eliminate exposure.</anigation> <parameter name="confidence">0.95 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109333 attacked?
It is attacked over the network.
Am I affected by CVE-2026-109333?
Check whether you run Surrealdb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 3.3.0

Until patched, on shared instances use separate SurrealDB deployments rather than namespace/database boundaries to isolate tenants. Issue namespace, database, and record-level credentials only to parties trusted with all tenants on the instance. Prefer PERMISSIONS WHERE clauses that check caller identity over PERMISSIONS FULL, though this reduces but does not eliminate exposure.</anigation> <parameter name="confidence">0.95

Technical details

The vulnerability is an authorization bypass (CWE-862) in the FETCH query resolution path. Authenticated record-scoped users could switch to a foreign namespace or database via USE statements or headers, then read records by naming known record IDs in RETURN...FETCH queries; ordinary table scans correctly enforced tenant boundaries, but FETCH record resolution did not. The fix in 3.3.0 enforces tenant scope checks on all query operations including FETCH, ensuring users cannot select or access namespaces/databases outside their authenticated scope.

Affected products

  • SurrealDB SurrealDB 3.0.0 to 3.2.x

Timeline

  • 2026-09-28: disclosed
  • 2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.