Is CVE-2026-63738 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63738 being exploited in the wild.

How severe is CVE-2026-63738?

Medium severity, with a CVSS score of 4.3, published 20 July 2026.

Which products and versions are affected?

surrealdb (crates.io) SEMVER:introduced=3.1.0,fixed=3.1.5.

Is there a fix for CVE-2026-63738?

Yes. surrealdb (crates.io): upgrade to 3.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63738 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-63738?

Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63738: SurrealDB field-level SELECT permission bypass in graph traversals

CVE-2026-63738 · Severity: medium · CVSS 4.3 · Published 2026-07-20

SurrealDB, a multi-model database, contains a flaw where certain data fields can be viewed by unauthorized users. While the system correctly blocks direct access to sensitive fields, users with basic access to a table can bypass these restrictions by using specific database relationship queries (graph traversals). This could allow an attacker to read sensitive information they are supposed to be restricted from seeing, though they cannot modify or delete any data.

Technologies: surrealdb (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-63738 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63738 being exploited in the wild.
How severe is CVE-2026-63738?: Medium severity, with a CVSS score of 4.3, published 20 July 2026.
Which products and versions are affected?: surrealdb (crates.io) SEMVER:introduced=3.1.0,fixed=3.1.5.
Is there a fix for CVE-2026-63738?: Yes. surrealdb (crates.io): upgrade to 3.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63738 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-63738?: Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

surrealdb (crates.io): upgrade to 3.1.5 or later
```
cargo update -p surrealdb
```

Technical details

An authorization bypass exists in SurrealDB's query execution engine. The shared 'resolve_record_batch' helper, used by GraphEdgeScan and ReferenceScan, fails to apply field-level filtering (build_field_state/filter_fields_by_permission) that is normally present in standard table scans. An attacker with table-level SELECT privileges can exploit this by using graph-edge (->) or back-reference (<~) traversals to materialize full records, thereby exposing fields explicitly hidden by 'DEFINE FIELD ... PERMISSIONS FOR select NONE' statements. The vulnerability is limited to confidentiality; it does not bypass row-level WHERE predicates or allow unauthorized cross-table access. The issue is patched in version 3.1.5.

Affected products

surrealdb surrealdb >= 3.1.0, < 3.1.5

Identifiers

CVE-2026-63738
GHSA-hv6h-hc26-q48p

Timeline

2026-06-19: advisory: GHSA-hv6h-hc26-q48p published by SurrealDB
2026-07-20: disclosed: NVD publication of CVE-2026-63738
2026-07-20: patched: Fix released in version 3.1.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.