# CVE-2026-63738: SurrealDB field-level SELECT permission bypass in graph traversals

Source: https://junglewise.ai/threats/cve-2026-63738-surrealdb-field-level-select-permission-bypass-in-graph  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-63738 · Severity: medium · CVSS 4.3 · Published 2026-07-20

SurrealDB, a multi-model database, contains a flaw where certain data fields can be viewed by unauthorized users. While the system correctly blocks direct access to sensitive fields, users with basic access to a table can bypass these restrictions by using specific database relationship queries (graph traversals). This could allow an attacker to read sensitive information they are supposed to be restricted from seeing, though they cannot modify or delete any data.

Technologies: [surrealdb (crates.io)](https://junglewise.ai/threats/technologies/surrealdb). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-63738 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63738 being exploited in the wild.

**How severe is CVE-2026-63738?** Medium severity, with a CVSS score of 4.3, published 20 July 2026.

**Which products and versions are affected?** surrealdb (crates.io) SEMVER:introduced=3.1.0,fixed=3.1.5.

**Is there a fix for CVE-2026-63738?** Yes. surrealdb (crates.io): upgrade to 3.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63738 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63738?** Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- surrealdb (crates.io): upgrade to 3.1.5 or later

  ```sh
  cargo update -p surrealdb
  ```


## Technical details

An authorization bypass exists in SurrealDB's query execution engine. The shared 'resolve_record_batch' helper, used by GraphEdgeScan and ReferenceScan, fails to apply field-level filtering (build_field_state/filter_fields_by_permission) that is normally present in standard table scans. An attacker with table-level SELECT privileges can exploit this by using graph-edge (->) or back-reference (<~) traversals to materialize full records, thereby exposing fields explicitly hidden by 'DEFINE FIELD ... PERMISSIONS FOR select NONE' statements. The vulnerability is limited to confidentiality; it does not bypass row-level WHERE predicates or allow unauthorized cross-table access. The issue is patched in version 3.1.5.

## Affected products

- surrealdb surrealdb >= 3.1.0, < 3.1.5

## Identifiers

- CVE-2026-63738
- GHSA-hv6h-hc26-q48p

## Timeline

- 2026-06-19: advisory: GHSA-hv6h-hc26-q48p published by SurrealDB
- 2026-07-20: disclosed: NVD publication of CVE-2026-63738
- 2026-07-20: patched: Fix released in version 3.1.5

## References

- [https://github.com/surrealdb/surrealdb/security/advisories/GHSA-hv6h-hc26-q48p](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-hv6h-hc26-q48p)
- [https://www.vulncheck.com/advisories/surrealdb-before-field-permission-bypass-via-traversal](https://www.vulncheck.com/advisories/surrealdb-before-field-permission-bypass-via-traversal)

## Related threats

- [SurrealDB use-after-free in KV backends via affinitypool spawn_local](https://junglewise.ai/threats/cve-2026-121417-surrealdb-before-3-3-0-contains-a-use-after-free-vulnerability)
- [SurrealDB JSON parser denial of service via uncontrolled recursion](https://junglewise.ai/threats/surrealdb-json-parser-denial-of-service-via-uncontrolled-recursion-3037f8a0)
- [SurrealDB ES512 algorithm silently downgraded to ES384](https://junglewise.ai/threats/surrealdb-es512-algorithm-silently-downgraded-to-es384-f0af29b8)
- [SurrealDB permission bypass via WHERE clause evaluation](https://junglewise.ai/threats/surrealdb-permission-bypass-via-where-clause-evaluation-afa6f001)
- [SurrealDB authorization bypass in KILL statement](https://junglewise.ai/threats/surrealdb-authorization-bypass-in-kill-statement-fc230d0f)