CVE-2026-109334: SurrealDB authorization bypass via namespace/database context

CVE-2026-109334 · Severity: high · CVSS 8.1 · Published 2026-10-12

SurrealDB is a database platform that manages data across isolated tenants and namespaces using authentication scopes. A flaw allows an authenticated attacker with credentials for one tenant to access another tenant's data by manipulating HTTP headers or RPC calls. An attacker can read, modify, or delete rows and configuration values in other tenants, provided the target table permits those operations.

Technologies: Surrealdb. Vendors: SurrealDB.

Quick answers

Is CVE-2026-109334 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-109334 being exploited in the wild.
How severe is CVE-2026-109334?
High severity, with a CVSS score of 8.1, published 12 October 2026.
Which products and versions are affected?
Surrealdb before 3.3.0.
Is there a fix for CVE-2026-109334?
Yes: fixed in 3.3.0. Until then: On shared instances, use separate deployments rather than namespace/database boundaries to isolate tenants. Until upgrading, issue namespace-, database-, and record-level credentials only to trusted parties, and prefer PERMISSIONS WHERE clauses that check caller identity over PERMISSIONS FULL. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109334 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-109334?
Check whether you run Surrealdb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 3.3.0

On shared instances, use separate deployments rather than namespace/database boundaries to isolate tenants. Until upgrading, issue namespace-, database-, and record-level credentials only to trusted parties, and prefer PERMISSIONS WHERE clauses that check caller identity over PERMISSIONS FULL.

Technical details

The vulnerability is an authorization bypass in SurrealDB's tenant isolation logic. System users authenticated at the namespace or database level can override the selected namespace/database via the Surreal-NS/Surreal-DB HTTP headers or the RPC use method without validation against their authenticated level. Queries then execute against the foreign tenant with the attacker's identity unchanged, bypassing table PERMISSIONS that would normally enforce access control. Requires valid authentication to some namespace/database on the instance; affects versions before 3.3.0.

Affected products

  • SurrealDB SurrealDB before 3.3.0

Timeline

  • 2026-09-28: disclosed
  • 2026-10-12: advisory
  • 2026-10-12: patched: version 3.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.