# SurrealDB information disclosure via error messages

Source: https://junglewise.ai/threats/surrealdb-information-disclosure-via-error-messages-96515867  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4.3 · Published 2026-07-20

SurrealDB is an open-source database management system that supports field-level access control to restrict which users can view specific data fields. A vulnerability in versions before 3.1.0 allows authenticated users with UPDATE permissions to read hidden fields by intentionally triggering error messages that expose field values. An attacker could read sensitive customer data, API keys, or other confidential information that was intended to be protected by access controls.

Technologies: [surrealdb (crates.io)](https://junglewise.ai/threats/technologies/surrealdb). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4.3, published 20 July 2026.

**Which products and versions are affected?** surrealdb (crates.io) < 3.1.0.

**Is there a fix for This vulnerability?** A patch was published on 2026-05-27: Patched in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an information disclosure vulnerability (CWE-209) in SurrealDB's error handling for arithmetic and extend operations. The root cause is that when UPDATE permission checks evaluate against unreduced documents, arithmetic operators and extend operations embed raw operand values into error messages without sanitization. An authenticated attacker with UPDATE access can trigger type incompatibility errors (e.g., attempting string + integer) on hidden fields, causing the field value to be included in the resulting error message. This bypasses field-level SELECT permissions that should restrict access. The vulnerability requires authentication and UPDATE privilege on the affected records, but no user interaction. A patch in version 3.1.0 replaced raw operand values with type names ("string", "int", "array", etc.) in error messages, eliminating the information disclosure.

## Affected products

- SurrealDB SurrealDB < 3.1.0

## Timeline

- 2026-05-27: disclosed: Original advisory GHSA-6g9v-7gq3-p2c6 published
- 2026-07-20: advisory: Duplicate advisory GHSA-p7hp-79jj-q923 published
- 2026-05-27: patched: Patched in version 3.1.0

## References

- [https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6g9v-7gq3-p2c6](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6g9v-7gq3-p2c6)
- [https://www.vulncheck.com/advisories/surrealdb-before-information-disclosure-via-error-messages](https://www.vulncheck.com/advisories/surrealdb-before-information-disclosure-via-error-messages)

## Related threats

- [SurrealDB use-after-free in KV backends via affinitypool spawn_local](https://junglewise.ai/threats/cve-2026-121417-surrealdb-before-3-3-0-contains-a-use-after-free-vulnerability)
- [SurrealDB JSON parser denial of service via uncontrolled recursion](https://junglewise.ai/threats/surrealdb-json-parser-denial-of-service-via-uncontrolled-recursion-3037f8a0)
- [SurrealDB ES512 algorithm silently downgraded to ES384](https://junglewise.ai/threats/surrealdb-es512-algorithm-silently-downgraded-to-es384-f0af29b8)
- [SurrealDB permission bypass via WHERE clause evaluation](https://junglewise.ai/threats/surrealdb-permission-bypass-via-where-clause-evaluation-afa6f001)
- [SurrealDB authorization bypass in KILL statement](https://junglewise.ai/threats/surrealdb-authorization-bypass-in-kill-statement-fc230d0f)