Executive brief
SurrealDB is a multi-model database used for managing and querying application data. A security flaw in its primary communication interface allows an unauthorized person to potentially hijack the permissions of a legitimate user. By sending specifically timed requests, an attacker could gain full control over the database, allowing them to read, modify, or delete sensitive customer information and administrative settings.
Technical details
A time-of-check/time-of-use (TOCTOU) race condition exists within the HTTP /rpc endpoint of SurrealDB. The vulnerability stems from the handler's failure to isolate session contexts for individual requests, instead utilizing a shared mutable state for authentication. An unauthenticated attacker can exploit this by sending concurrent requests to the /rpc endpoint while legitimate authenticated traffic is being processed. If the attacker's request is processed during the window where a legitimate session is active but not yet cleared, the attacker's request executes with the privileges of that authenticated user. This can lead to full database compromise if a root or namespace-level session is hijacked. The issue is resolved in version 3.1.0 by implementing per-request session isolation using unique UUIDs.
Affected products
- SurrealDB SurrealDB < 3.1.0
Timeline
- 2026-05-27: advisory: Initial GitHub Security Advisory published
- 2026-07-20: disclosed: CVE-2026-63756 published to NVD
- 2026-07-20: patched: Fix confirmed in version 3.1.0