Executive brief
SurrealDB is a multi-model cloud database. A vulnerability in how it handles session commands allowed unauthenticated users to create new namespaces and databases without proper authorization. While attackers could not access existing data, they could use this to clutter the system, recreate deleted organizational structures, or exhaust storage space.
Technical details
A missing authorization check in SurrealDB's 'USE NS' and 'USE DB' commands allowed for implicit resource creation by unauthorized or unauthenticated users. The vulnerability existed in three entry points: the RPC 'use' method, 'Datastore::process_use', and the SurrealQL executor. An attacker could exploit this to create arbitrary namespaces/databases, recreate dropped parent namespaces using stale tokens, or perform a denial-of-service by exhausting catalog storage. The exploit does not grant access to existing data or privilege escalation. The issue is fixed in version 3.1.0 by enforcing DEFINE-level authorization checks during the implicit creation step.
Affected products
- SurrealDB surrealdb < 3.1.0
Timeline
- 2026-05-25: patched: Fix committed to repository
- 2026-05-27: disclosed: Initial advisory publication
- 2026-07-01: advisory: Advisory updated/reviewed