Executive brief
SurrealDB is a multi-model database that supports real-time data subscriptions. A security flaw allows any authenticated user to terminate the real-time data feeds of other users within the same database. This can lead to silent service disruptions where applications stop receiving critical data updates without any notification or error message.
Technical details
A missing authorization check in the KILL statement implementation within `core/src/expr/statements/kill.rs` allows for an IDOR-like vulnerability. While the system verifies the requester has database-level access, it fails to verify ownership of the specific live query UUID being terminated. An attacker with network access and low-privilege credentials can issue a KILL command with a target UUID to silently delete another user's LIVE SELECT subscription. This bypasses multi-tenant isolation and impacts availability. The vulnerability is patched in version 3.1.0 by introducing an ownership verification check.
Affected products
- SurrealDB surrealdb < 3.1.0
Timeline
- 2026-05-27: disclosed: Initial publication of the advisory
- 2026-05-27: patched: Fix committed in version 3.1.0
- 2026-07-01: advisory: Published to GitHub Advisory Database