# CVE-2026-109335: SurrealDB information disclosure via COMPUTED fields

Source: https://junglewise.ai/threats/cve-2026-109335-surrealdb-from-3-0-0-before-3-3-0-contains-an-information  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109335 · Severity: medium · CVSS 6.5 · Published 2026-10-12

SurrealDB is a database system that allows fine-grained field-level access control on records. A vulnerability in versions 3.0.0 through 3.2.x allows users with read or write access to bypass these field-level permissions and view hidden data through computed fields or write operations. An attacker with basic record access can extract sensitive values that administrators intended to keep hidden.

Technologies: [Surrealdb](https://junglewise.ai/threats/technologies/surrealdb-surrealdb). Vendors: [SurrealDB](https://junglewise.ai/threats/vendors/surrealdb).

## Quick answers

**Is CVE-2026-109335 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109335 being exploited in the wild.

**How severe is CVE-2026-109335?** Medium severity, with a CVSS score of 6.5, published 12 October 2026.

**Which products and versions are affected?** Surrealdb 3.0.0 to 3.2.x.

**Is there a fix for CVE-2026-109335?** Yes: fixed in 3.3.0. Until then: For read operations, force the legacy executor with the --planner-strategy compute-only flag (or SURREAL_PLANNER_STRATEGY environment variable). Apply matching SELECT permissions to readable COMPUTED fields and the stored fields they read from. Do not rely solely on COMPUTED field SELECT permissions to hide data from users who can write records.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-09-28"},{"kind":"advisory","at":"2026-10-12"},{"kind":"patched","at":"2026-10-12","note":"Fixed in version 3.3.0"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109335 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-109335?** Check whether you run Surrealdb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.3.0

For read operations, force the legacy executor with the --planner-strategy compute-only flag (or SURREAL_PLANNER_STRATEGY environment variable). Apply matching SELECT permissions to readable COMPUTED fields and the stored fields they read from. Do not rely solely on COMPUTED field SELECT permissions to hide data from users who can write records.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-09-28"},{"kind":"advisory","at":"2026-10-12"},{"kind":"patched","at":"2026-10-12","note":"Fixed in version 3.3.0"}]

## Technical details

The vulnerability stems from two distinct issues: (1) the streaming query planner evaluates COMPUTED fields before removing hidden fields from the record, allowing readable COMPUTED fields derived from hidden fields to retain their values; and (2) write operations with RETURN clauses can expose hidden COMPUTED fields through $before/$after or aliases. The attack requires existing SELECT or write permissions on the affected table; table-level and system-level permissions are not bypassed.

## Affected products

- SurrealDB SurrealDB 3.0.0 to 3.2.x

## References

- [https://github.com/surrealdb/surrealdb/security/advisories/GHSA-2jj6-v2fq-rwpp](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-2jj6-v2fq-rwpp)
- [https://www.vulncheck.com/advisories/surrealdb-3.0.0-before-3.3.0-information-disclosure-via-computed-fields](https://www.vulncheck.com/advisories/surrealdb-3.0.0-before-3.3.0-information-disclosure-via-computed-fields)

## Related threats

- [SurrealDB unbounded recursion in value serialization](https://junglewise.ai/threats/cve-2026-121423-surrealdb-before-3-3-0-contains-an-unbounded-recursion)
- [SurrealDB server-side request forgery in JWKS URL validation](https://junglewise.ai/threats/cve-2026-121422-surrealdb-from-3-1-0-before-3-3-0-contains-a-server-side-request)
- [SurrealDB server-side request forgery in network deny rules](https://junglewise.ai/threats/cve-2026-121421-surrealdb-3-1-0-before-3-3-0-contains-a-server-side-request)
- [SurrealDB MCP session hijack via BoundSubject fingerprint collision](https://junglewise.ai/threats/cve-2026-121419-surrealdb-from-3-1-0-before-3-3-0-contains-an-improper)
- [SurrealDB authorization bypass via streaming index planner](https://junglewise.ai/threats/cve-2026-121418-surrealdb-from-3-1-0-before-3-3-0-contains-an-incorrect)