CVE-2026-109342: SurrealDB missing authentication in revoke RPC method

CVE-2026-109342 · Severity: medium · CVSS 5.4 · Published 2026-10-12

SurrealDB is a database platform that issues refresh tokens to allow users to maintain authenticated sessions. A flaw in the revoke RPC method allows attackers with low privileges or knowledge of token identifiers to permanently invalidate other users' refresh tokens without proving they possess the token. This forces legitimate users to re-authenticate, disrupting their work.

Technologies: Surrealdb. Vendors: SurrealDB.

Quick answers

Is CVE-2026-109342 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-109342 being exploited in the wild.
How severe is CVE-2026-109342?
Medium severity, with a CVSS score of 5.4, published 12 October 2026.
Which products and versions are affected?
Surrealdb 3.0.0 before 3.3.0.
Is there a fix for CVE-2026-109342?
Yes: fixed in 3.3.0. Until then: Deny the revoke RPC method via capabilities if token revocation is not required (e.g., --deny-rpc revoke), or restrict network access to the /rpc endpoint to trusted clients. Treat grant identifiers as sensitive and limit who can run ACCESS queries that disclose them. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109342 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-109342?
Check whether you run Surrealdb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 3.3.0

Deny the revoke RPC method via capabilities if token revocation is not required (e.g., --deny-rpc revoke), or restrict network access to the /rpc endpoint to trusted clients. Treat grant identifiers as sensitive and limit who can run ACCESS queries that disclose them.

Technical details

The revoke RPC method in SurrealDB 3.0.0 through 3.2.x performs no authentication or proof-of-possession check before revoking a refresh token. An attacker who learns a grant identifier—either through querying ACCESS with VIEWER permission or via a leaked token—can call revoke with that identifier and the operation succeeds without verification. The fix requires proof of possession by constant-time comparison of the presented refresh key against the stored grant.

Affected products

  • SurrealDB SurrealDB 3.0.0 before 3.3.0

Timeline

  • 2026-09-28: disclosed
  • 2026-10-12: advisory
  • 2026: patched: Fix included in version 3.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.