CVE-2026-109341: SurrealDB authorization bypass in PATCH operations

CVE-2026-109341 · Severity: high · CVSS 7.1 · Published 2026-10-12

SurrealDB is a real-time database used for storing and querying structured data. This vulnerability allows users with write access to a table to read fields they should not be able to see by manipulating JSON Patch operations. An attacker could extract sensitive data that is restricted from their view, such as hidden user information or financial records, and either expose it immediately or persist it to other fields for later retrieval.

Technologies: Surrealdb. Vendors: SurrealDB.

Quick answers

Is CVE-2026-109341 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-109341 being exploited in the wild.
How severe is CVE-2026-109341?
High severity, with a CVSS score of 7.1, published 12 October 2026.
Which products and versions are affected?
Surrealdb before 3.3.0.
Is there a fix for CVE-2026-109341?
Yes: fixed in 3.3.0. Until then: Do not grant table-level write permissions to principals who must not read SELECT-restricted fields on that table. Alternatively, restrict access at the table level, move sensitive fields to a separate table those principals cannot write, or route writes through DEFINE API endpoints or functions with the --deny-arbitrary-query flag enabled. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109341 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-109341?
Check whether you run Surrealdb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 3.3.0

Do not grant table-level write permissions to principals who must not read SELECT-restricted fields on that table. Alternatively, restrict access at the table level, move sensitive fields to a separate table those principals cannot write, or route writes through DEFINE API endpoints or functions with the --deny-arbitrary-query flag enabled.

Technical details

A field-level SELECT permission bypass in SurrealDB's PATCH operation handler allows principals with table-level write permissions (UPDATE, CREATE, UPSERT, RELATE, INSERT) to read restricted fields by resolving JSON Patch pointers against the unreduced record rather than the permission-filtered view. The copy and move operations can extract restricted field values into readable destinations, while test operations disclose values via error messages; the vulnerability affects nested fields and array elements, but does not bypass table-level permissions or access to records the attacker cannot already reach.

Affected products

  • SurrealDB SurrealDB before 3.3.0

Timeline

  • 2026-09-28: advisory
  • 2026-10-12: disclosed
  • 2026-10-12: patched: Version 3.3.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.