Executive brief
SurrealDB is a cloud-native database platform. A vulnerability in its real-time query feature allows a user with basic read access to block all other users, including administrators, from adding, updating, or deleting data in a specific table. This results in a denial-of-service condition that halts business operations and data processing for the affected tables until the malicious query is stopped.
Technical details
A denial of service (DoS) vulnerability exists in SurrealDB's LIVE query notification path. When a LIVE query is registered with a WHERE clause that triggers an evaluation error (e.g., passing an incorrect data type to a function), the error incorrectly propagates back to the transaction that triggered the notification. This causes any CREATE, UPDATE, or DELETE operation on the affected table to roll back and fail. An authenticated attacker with only 'select' permissions can exploit this to block all write operations by any user, including root. The issue is resolved in version 3.1.0 by decoupling LIVE query evaluation errors from the source transaction and deferring error notifications until after permission checks.
Affected products
- SurrealDB SurrealDB < 3.1.0
Timeline
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: NVD publication date