# SurrealDB session hijacking via HTTP RPC session leak

Source: https://junglewise.ai/threats/surrealdb-session-hijacking-via-http-rpc-session-leak-016308ef  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

Severity: high · CVSS 8.8 · Published 2026-07-01

SurrealDB is a multi-model database used for managing and storing application data. A security flaw in its HTTP interface allows unauthorized individuals to discover active user session IDs and use them to take over those accounts. An attacker could use this access to read, modify, or delete sensitive database information, potentially gaining full administrative control over the database.

Technologies: [surrealdb (crates.io)](https://junglewise.ai/threats/technologies/surrealdb). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 8.8, published 1 July 2026.

**Which products and versions are affected?** surrealdb (crates.io) < 3.1.0.

**Is there a fix for This vulnerability?** A patch was published on 3.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a hosted service.

**Am I affected?** Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A session fixation and information disclosure vulnerability exists in SurrealDB's HTTP /rpc implementation. The `sessions` method incorrectly returned all 'attached' session UUIDs to unauthenticated callers, while the /rpc handler failed to verify ownership of session IDs provided in the `session` field. An attacker can enumerate these UUIDs and impersonate any authenticated session that was registered via the `attach` method (commonly used by the official Rust SDK). This allows for full session hijacking, enabling the attacker to perform any action authorized for the victim session, including data manipulation and privilege escalation. The issue is fixed in version 3.1.0 by disabling the HTTP `sessions()` method and implementing strict ownership checks for session IDs.

## Affected products

- SurrealDB SurrealDB < 3.1.0

## Timeline

- 2026-05-27: disclosed: Initial disclosure date listed in researcher profile
- 2026-07-01: advisory: GitHub Advisory published
- 3.1.0: patched

## References

- [https://api.github.com/users/addcontent](https://api.github.com/users/addcontent)
- [https://github.com/addcontent](https://github.com/addcontent)
- [https://api.github.com/users/addcontent/gists%7B/gist_id%7D](https://api.github.com/users/addcontent/gists%7B/gist_id%7D)
- [https://api.github.com/users/addcontent/repos](https://api.github.com/users/addcontent/repos)
- [https://avatars.githubusercontent.com/u/59762500?v=4](https://avatars.githubusercontent.com/u/59762500?v=4)
- [https://api.github.com/users/addcontent/events%7B/privacy%7D](https://api.github.com/users/addcontent/events%7B/privacy%7D)

## Related threats

- [SurrealDB use-after-free in KV backends via affinitypool spawn_local](https://junglewise.ai/threats/cve-2026-121417-surrealdb-before-3-3-0-contains-a-use-after-free-vulnerability)
- [SurrealDB JSON parser denial of service via uncontrolled recursion](https://junglewise.ai/threats/surrealdb-json-parser-denial-of-service-via-uncontrolled-recursion-3037f8a0)
- [SurrealDB ES512 algorithm silently downgraded to ES384](https://junglewise.ai/threats/surrealdb-es512-algorithm-silently-downgraded-to-es384-f0af29b8)
- [SurrealDB permission bypass via WHERE clause evaluation](https://junglewise.ai/threats/surrealdb-permission-bypass-via-where-clause-evaluation-afa6f001)
- [SurrealDB authorization bypass in KILL statement](https://junglewise.ai/threats/surrealdb-authorization-bypass-in-kill-statement-fc230d0f)