SurrealDB uncaught exception in role conversion

Severity: medium · CVSS 4.9 · Published 2026-07-18

SurrealDB is a multi-model database used for building applications with complex data relationships. A denial-of-service vulnerability allows privileged owner-level users to create system accounts with invalid role assignments. When another user attempts to sign in with such an invalid role, the database server crashes due to an unhandled error, making the database unavailable to legitimate users.

Technologies: surrealdb (crates.io), Surrealdb-Core. Vendors: crates.io, SurrealDB.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 4.9, published 18 July 2026.
Which products and versions are affected?
surrealdb (crates.io) < 2.1.0; Surrealdb-Core < 2.1.0.
Is there a fix for This vulnerability?
A patch was published on 2024-11-22: Version 2.1.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run surrealdb (crates.io) or Surrealdb-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in SurrealDB's identity and access management (IAM) layer, specifically in the From&lt;&amp;Ident&gt; for Role trait implementation. Roles are stored as generic Ident values and converted to the Role enum during IAM operations. The conversion function expects only valid role values (owner, editor, viewer) but an unwrap() call on the result causes a panic if an invalid role is encountered. A privileged owner-level user can use DEFINE USER to create users with nonexistent roles; when the affected user signs in or performs operations requiring role validation, an unhandled exception crashes the server. The vulnerability requires owner-level privileges to exploit and affects versions before 2.1.0. Patches in version 2.1.0 and later reject invalid roles during user definition and handle nonexistent roles with proper error handling rather than panicking.

Affected products

  • SurrealDB SurrealDB < 2.1.0
  • SurrealDB surrealdb-core < 2.1.0

Timeline

  • 2024-11-22: disclosed
  • 2024-11-22: patched: Version 2.1.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.