Is CVE-2026-63763 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63763 being exploited in the wild.

How severe is CVE-2026-63763?

Medium severity, with a CVSS score of 4, published 20 July 2026.

Which products and versions are affected?

surrealdb (crates.io) SEMVER:introduced=0,fixed=2.5.0.

Is there a fix for CVE-2026-63763?

Yes. surrealdb (crates.io): upgrade to 2.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63763 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-63763?

Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63763: SurrealDB privilege escalation in futures and functions

CVE-2026-63763 · Severity: medium · CVSS 4 · Published 2026-07-20

SurrealDB is a multi-model cloud database. A security flaw allows users with limited permissions to plant malicious code within database records. If a high-privileged administrator later interacts with these records, the malicious code runs with the administrator's full authority, potentially allowing the attacker to take over the entire database server and create new root accounts.

Technologies: surrealdb (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-63763 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63763 being exploited in the wild.
How severe is CVE-2026-63763?: Medium severity, with a CVSS score of 4, published 20 July 2026.
Which products and versions are affected?: surrealdb (crates.io) SEMVER:introduced=0,fixed=2.5.0.
Is there a fix for CVE-2026-63763?: Yes. surrealdb (crates.io): upgrade to 2.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63763 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-63763?: Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

surrealdb (crates.io): upgrade to 2.5.0 or later
```
cargo update -p surrealdb
```

Technical details

A confused deputy vulnerability exists in SurrealDB's handling of 'futures', functions, and closures. Unprivileged users (such as those with the database editor role) can define or modify fields containing these executable elements. Because SurrealDB executes this logic in the security context of the user querying or writing to the record rather than the user who created it, an attacker can perform a privilege escalation attack. By planting malicious logic in a record, the attacker can wait for a root or namespace administrator to interact with that record, triggering the execution of the payload with elevated permissions. This can result in full server takeover or the creation of new root users. The fix introduces an 'auth_limit' to ensure logic executes with the lower of the creator's or invoker's permissions.

Affected products

surrealdb surrealdb < 2.5.0, < 3.0.0-beta.3

Identifiers

CVE-2026-63763
GHSA-3v2x-9xcv-2v2v

Timeline

2026-01-22: advisory: GHSA-3v2x-9xcv-2v2v published
2026-07-20: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.