CVE-2026-109337: SurrealDB field-level SELECT permission bypass in LIVE queries

CVE-2026-109337 · Severity: medium · CVSS 4.3 · Published 2026-10-12

SurrealDB is a database platform that uses field-level permissions to restrict which users can see specific fields in records. This vulnerability allows users with record-level access to infer the values of fields they shouldn't be able to read by repeatedly testing conditions in LIVE SELECT queries and observing whether notifications are sent. An attacker with basic database access can repeatedly craft queries to narrow down or confirm hidden field values, potentially exposing sensitive data stored in restricted fields.

Technologies: Surrealdb. Vendors: SurrealDB.

Quick answers

Is CVE-2026-109337 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-109337 being exploited in the wild.
How severe is CVE-2026-109337?
Medium severity, with a CVSS score of 4.3, published 12 October 2026.
Which products and versions are affected?
Surrealdb before 3.3.0.
Is there a fix for CVE-2026-109337?
Yes: fixed in 3.3.0. Until then: Do not rely on field-level SELECT permissions to hide values on tables that untrusted users can subscribe to; keep sensitive fields in a separate table or database those users cannot access, or restrict at the table level. Alternatively, deny live and arbitrary queries to untrusted principals using --deny-arbitrary-query flag to block LIVE queries for guest and record users.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-28"},{"kind":"advisory","at":"2026-10-12"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109337 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-109337?
Check whether you run Surrealdb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 3.3.0

Do not rely on field-level SELECT permissions to hide values on tables that untrusted users can subscribe to; keep sensitive fields in a separate table or database those users cannot access, or restrict at the table level. Alternatively, deny live and arbitrary queries to untrusted principals using --deny-arbitrary-query flag to block LIVE queries for guest and record users.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-28"},{"kind":"advisory","at":"2026-10-12"}]

Technical details

The vulnerability exists in how SurrealDB evaluates WHERE clauses in LIVE SELECT queries. The $before and $after parameters—which represent record state before and after mutations—are bound to the unreduced (unpermissioned) record instead of the per-subscriber reduced view, allowing attackers to test field-level SELECT permissions in predicates and infer hidden values from notification delivery. An attacker with record-level permission to subscribe to a table can craft repeated WHERE predicates testing a restricted field's value and use the presence or absence of a notification as a boolean oracle to confirm exact values or narrow value ranges across CREATE, UPDATE, and DELETE operations.

Affected products

  • SurrealDB SurrealDB before 3.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.