SurrealDB privilege escalation via HTTP RPC session race condition

Executive brief

SurrealDB, a multi-model database, contains a vulnerability in its primary communication interface that allows an attacker to hijack active user sessions. By sending specifically timed requests, an unauthenticated attacker can inherit the permissions of a legitimate user who is currently logged in. This could lead to unauthorized access to sensitive data, data deletion, or full administrative control over the database instance.

Technical details

A time-of-check/time-of-use (TOCTOU) race condition exists in the HTTP /rpc endpoint of SurrealDB due to improper isolation of internal session state. The handler fails to bind incoming requests to unique session contexts, instead utilizing a shared mutable state for authentication. An attacker can exploit this by sending concurrent requests; if an unauthenticated request is processed while an authenticated request's session context is active but not yet cleared, the unauthenticated request executes with the higher privilege level. This can result in full privilege escalation to root or namespace-level access. The vulnerability is patched in version 3.1.0 by implementing per-request session isolation using server-side UUIDs.

Affected products

• SurrealDB SurrealDB < 3.1.0

Timeline

• 2026-05-27: disclosed
• 2026-07-01: advisory: GitHub Advisory published
• 2026-07-01: patched: Patch confirmed in version 3.1.0

References

• https://api.github.com/users/addcontent
• https://github.com/addcontent
• https://api.github.com/users/addcontent/gists%7B/gist_id%7D
• https://api.github.com/users/addcontent/repos
• https://avatars.githubusercontent.com/u/59762500?v=4
• https://api.github.com/users/addcontent/events%7B/privacy%7D