Is CVE-2026-109336 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109336 being exploited in the wild.

How severe is CVE-2026-109336?

Medium severity, with a CVSS score of 4.3, published 12 October 2026.

How is CVE-2026-109336 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-109336?

Check whether you run Surrealdb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109336: SurrealDB field-level SELECT authorization bypass in LIVE queries

CVE-2026-109336 · Severity: medium · CVSS 4.3 · Published 2026-10-12

SurrealDB is a multi-model database engine. A vulnerability allows users with permission to run LIVE SELECT queries to read database fields that field-level access controls should hide from them by exploiting the $before and $after parameters in CREATE, UPDATE, and DELETE notifications. An attacker cannot access records they shouldn't see or modify data, but can view sensitive field values they should not have read access to.

Technologies: Surrealdb. Vendors: SurrealDB.

Quick answers

Is CVE-2026-109336 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109336 being exploited in the wild.
How severe is CVE-2026-109336?: Medium severity, with a CVSS score of 4.3, published 12 October 2026.
Which products and versions are affected?: Surrealdb before 3.3.0.
Is there a fix for CVE-2026-109336?: Yes: fixed in 3.3.0. Until then: Do not rely on field-level SELECT permissions alone to hide sensitive data from users who can run LIVE SELECT queries on a table; instead store sensitive fields in a separate table or database with table-level access restrictions. Alternatively, deny live and arbitrary queries to untrusted principal classes using the --deny-arbitrary-query flag.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-28"}, {"kind": "advisory", "at": "2026-10-12"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109336 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-109336?: Check whether you run Surrealdb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.3.0

Do not rely on field-level SELECT permissions alone to hide sensitive data from users who can run LIVE SELECT queries on a table; instead store sensitive fields in a separate table or database with table-level access restrictions. Alternatively, deny live and arbitrary queries to untrusted principal classes using the --deny-arbitrary-query flag.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-28"}, {"kind": "advisory", "at": "2026-10-12"}]

Technical details

The vulnerability is an authorization bypass in LIVE SELECT query handling (CWE-863). Record users can project restricted fields from the unreduced $before or $after event parameters using an alias, bypassing field-level SELECT permissions that apply to the main notification payload. The fix in version 3.3.0 binds these parameters to the same per-subscriber reduced views used for the notification, preventing the bypass. The attack requires table-level SELECT permission but no specific field permissions.

Affected products

SurrealDB SurrealDB before 3.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.