Executive brief
SurrealDB, a multi-model database, is affected by a vulnerability that allows unauthorized users to take over active database sessions. By accessing a specific internal communication endpoint, an attacker can discover the unique identifiers of logged-in users and impersonate them. This could allow an attacker to read, modify, or delete sensitive data and gain full administrative control over the database.
Technical details
A session hijacking vulnerability exists in SurrealDB's HTTP RPC interface due to missing authentication and ownership verification. The '/rpc sessions' method improperly leaks the UUIDs of all 'attached' sessions (typically created by the Rust SDK) to unauthenticated callers. Furthermore, the RPC handler fails to verify session ownership, allowing an attacker to provide a stolen UUID in the session field of a request to impersonate an authenticated user. This enables full unauthorized access to data and privilege escalation to the level of the hijacked session, including root. The issue is resolved in version 3.1.0 by disabling session enumeration over HTTP and implementing strict ownership checks for session IDs.
Affected products
- SurrealDB SurrealDB < 3.1.0
Timeline
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD