Executive brief
SurrealDB is a multi-model cloud database. A security flaw allows users with limited permissions to plant malicious code within database records. If a high-privileged administrator later interacts with these records, the malicious code runs with the administrator's full authority, potentially allowing the attacker to take over the entire database server and create new root accounts.
Technical details
A confused deputy vulnerability exists in SurrealDB's handling of 'futures', functions, and closures. Unprivileged users (such as those with the database editor role) can define or modify fields containing these executable elements. Because SurrealDB executes this logic in the security context of the user querying or writing to the record rather than the user who created it, an attacker can perform a privilege escalation attack. By planting malicious logic in a record, the attacker can wait for a root or namespace administrator to interact with that record, triggering the execution of the payload with elevated permissions. This can result in full server takeover or the creation of new root users. The fix introduces an 'auth_limit' to ensure logic executes with the lower of the creator's or invoker's permissions.
Affected products
- surrealdb surrealdb < 2.5.0, < 3.0.0-beta.3
Timeline
- 2026-01-22: advisory: GHSA-3v2x-9xcv-2v2v published
- 2026-07-20: disclosed: NVD publication date