# Surrealdb vulnerabilities Source: https://junglewise.ai/threats/technologies/surrealdb-surrealdb Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/surrealdb-surrealdb.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 31 vulnerabilities in Surrealdb: 0 in the last 7 days and 18 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121423, was published on 3 November 2026. 17 vulnerabilities in the last four weeks, up 1600% on the four before (1). ## Counts - Last 7 days: 0 - Last 30 days: 6 - Last 90 days: 18 - All time: 31 (1 critical, 0 exploited in the wild) ## About Surrealdb Multi-model database designed for cloud-native applications with real-time capabilities. ## Latest Surrealdb vulnerabilities - [CVE-2026-121423: SurrealDB unbounded recursion in value serialization](https://junglewise.ai/threats/cve-2026-121423-surrealdb-before-3-3-0-contains-an-unbounded-recursion) (medium, CVSS 6.5, published 3 Nov 2026) - [CVE-2026-121422: SurrealDB server-side request forgery in JWKS URL validation](https://junglewise.ai/threats/cve-2026-121422-surrealdb-from-3-1-0-before-3-3-0-contains-a-server-side-request) (medium, CVSS 4.1, published 3 Nov 2026) - [CVE-2026-121421: SurrealDB server-side request forgery in network deny rules](https://junglewise.ai/threats/cve-2026-121421-surrealdb-3-1-0-before-3-3-0-contains-a-server-side-request) (medium, CVSS 4.3, published 3 Nov 2026) - [CVE-2026-121419: SurrealDB MCP session hijack via BoundSubject fingerprint collision](https://junglewise.ai/threats/cve-2026-121419-surrealdb-from-3-1-0-before-3-3-0-contains-an-improper) (high, CVSS 8.1, published 3 Nov 2026) - [CVE-2026-121418: SurrealDB authorization bypass via streaming index planner](https://junglewise.ai/threats/cve-2026-121418-surrealdb-from-3-1-0-before-3-3-0-contains-an-incorrect) (medium, CVSS 4.3, published 3 Nov 2026) - [CVE-2026-121416: SurrealDB deny-funcs capability bypass via method-style invocations](https://junglewise.ai/threats/cve-2026-121416-surrealdb-2-0-0-before-3-3-1-does-not-enforce-deny-funcs) (high, CVSS 7.1, published 3 Nov 2026) - [CVE-2026-109343: SurrealDB authorization bypass in USE statement](https://junglewise.ai/threats/cve-2026-109343-surrealdb-before-3-3-0-allows-cross-tenant-access-because-the) (high, CVSS 8.1, published 12 Oct 2026) - [CVE-2026-109342: SurrealDB missing authentication in revoke RPC method](https://junglewise.ai/threats/cve-2026-109342-surrealdb-from-3-0-0-before-3-3-0-contains-a-missing) (medium, CVSS 5.4, published 12 Oct 2026) - [CVE-2026-109341: SurrealDB authorization bypass in PATCH operations](https://junglewise.ai/threats/cve-2026-109341-surrealdb-before-3-3-0-contains-an-authorization-bypass) (high, CVSS 7.1, published 12 Oct 2026) - [CVE-2026-109340: SurrealDB authorization bypass in graph edge deletion via CASCADE](https://junglewise.ai/threats/cve-2026-109340-surrealdb-from-3-1-0-before-3-3-0-contains-an-authorization) (medium, CVSS 5.4, published 12 Oct 2026) - [CVE-2026-109339: SurrealDB Surrealism module memory exhaustion via unbounded output buffering](https://junglewise.ai/threats/cve-2026-109339-surrealdb-3-1-0-before-3-3-0-lets-surrealism-modules-exhaust) (medium, CVSS 4.9, published 12 Oct 2026) - [CVE-2026-109338: SurrealDB denial of service via non-ASCII header values](https://junglewise.ai/threats/cve-2026-109338-surrealdb-before-3-3-0-contains-a-denial-of-service) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109337: SurrealDB field-level SELECT permission bypass in LIVE queries](https://junglewise.ai/threats/cve-2026-109337-surrealdb-before-3-3-0-contains-an-authorization-bypass) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-109336: SurrealDB field-level SELECT authorization bypass in LIVE queries](https://junglewise.ai/threats/cve-2026-109336-surrealdb-before-3-3-0-contains-an-authorization-bypass) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-109335: SurrealDB information disclosure via COMPUTED fields](https://junglewise.ai/threats/cve-2026-109335-surrealdb-from-3-0-0-before-3-3-0-contains-an-information) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109334: SurrealDB authorization bypass via namespace/database context](https://junglewise.ai/threats/cve-2026-109334-surrealdb-before-3-3-0-does-not-check-the-caller-selected) (high, CVSS 8.1, published 12 Oct 2026) - [CVE-2026-109333: SurrealDB authorization bypass in FETCH query resolution](https://junglewise.ai/threats/cve-2026-109333-surrealdb-from-3-0-0-before-3-3-0-contains-an-authorization) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-102876: SurrealDB authorization bypass in HTTP session construction](https://junglewise.ai/threats/cve-2026-102876-surrealdb-before-3-3-0-contains-an-authorization-bypass-in-http) (high, CVSS 8.1, published 29 Sep 2026) - [CVE-2026-63763: SurrealDB privilege escalation in futures and functions](https://junglewise.ai/threats/cve-2026-63763-surrealdb-privilege-escalation-in-futures-and-functions) (medium, CVSS 4, published 20 Jul 2026) - [CVE-2026-63762: SurrealDB denial of service in JavaScript scripting engine](https://junglewise.ai/threats/cve-2026-63762-surrealdb-denial-of-service-in-javascript-scripting-engine) (medium, CVSS 4, published 20 Jul 2026) - [CVE-2025-71398: SurrealDB SSRF via HTTP redirect bypass in http functions](https://junglewise.ai/threats/cve-2025-71398-surrealdb-ssrf-via-http-redirect-bypass-in-http-functions) (medium, CVSS 4, published 18 Jul 2026) - [CVE-2025-71397: SurrealDB denial of service via nested FOR loops in custom functions](https://junglewise.ai/threats/cve-2025-71397-surrealdb-denial-of-service-via-nested-for-loops-in-custom) (medium, CVSS 4, published 18 Jul 2026) - [CVE-2025-71396: SurrealDB denial of service via embedded JavaScript scripting](https://junglewise.ai/threats/cve-2025-71396-surrealdb-denial-of-service-via-embedded-javascript-scripting) (medium, CVSS 4, published 18 Jul 2026) - [CVE-2025-71395: SurrealDB memory exhaustion in string::replace function](https://junglewise.ai/threats/cve-2025-71395-surrealdb-memory-exhaustion-in-string-replace-function) (medium, CVSS 4, published 18 Jul 2026) - [CVE-2025-71394: SurrealDB local file read in DEFINE ANALYZER statement](https://junglewise.ai/threats/cve-2025-71394-surrealdb-local-file-read-in-define-analyzer-statement) (medium, CVSS 4, published 18 Jul 2026) ## Most severe Surrealdb vulnerabilities - [CVE-2025-71392: SurrealDB SurrealQL injection in command-line export](https://junglewise.ai/threats/cve-2025-71392-surrealdb-surrealql-injection-in-command-line-export) (critical, CVSS 4, published 18 Jul 2026) - [CVE-2024-58362: SurrealDB query injection in RPC API signin and signup operations](https://junglewise.ai/threats/cve-2024-58362-surrealdb-query-injection-in-rpc-api-signin-and-signup-operations) (high, CVSS 8.8, published 18 Jul 2026) - [CVE-2026-109343: SurrealDB authorization bypass in USE statement](https://junglewise.ai/threats/cve-2026-109343-surrealdb-before-3-3-0-allows-cross-tenant-access-because-the) (high, CVSS 8.1, published 12 Oct 2026) - [CVE-2026-109334: SurrealDB authorization bypass via namespace/database context](https://junglewise.ai/threats/cve-2026-109334-surrealdb-before-3-3-0-does-not-check-the-caller-selected) (high, CVSS 8.1, published 12 Oct 2026) - [CVE-2026-121419: SurrealDB MCP session hijack via BoundSubject fingerprint collision](https://junglewise.ai/threats/cve-2026-121419-surrealdb-from-3-1-0-before-3-3-0-contains-an-improper) (high, CVSS 8.1, published 3 Nov 2026) - [CVE-2026-102876: SurrealDB authorization bypass in HTTP session construction](https://junglewise.ai/threats/cve-2026-102876-surrealdb-before-3-3-0-contains-an-authorization-bypass-in-http) (high, CVSS 8.1, published 29 Sep 2026) - [CVE-2026-109341: SurrealDB authorization bypass in PATCH operations](https://junglewise.ai/threats/cve-2026-109341-surrealdb-before-3-3-0-contains-an-authorization-bypass) (high, CVSS 7.1, published 12 Oct 2026) - [CVE-2026-121416: SurrealDB deny-funcs capability bypass via method-style invocations](https://junglewise.ai/threats/cve-2026-121416-surrealdb-2-0-0-before-3-3-1-does-not-enforce-deny-funcs) (high, CVSS 7.1, published 3 Nov 2026) - [CVE-2026-109338: SurrealDB denial of service via non-ASCII header values](https://junglewise.ai/threats/cve-2026-109338-surrealdb-before-3-3-0-contains-a-denial-of-service) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109335: SurrealDB information disclosure via COMPUTED fields](https://junglewise.ai/threats/cve-2026-109335-surrealdb-from-3-0-0-before-3-3-0-contains-an-information) (medium, CVSS 6.5, published 12 Oct 2026) ## Vulnerabilities per week 17 vulnerabilities in the last four weeks, up 1600% on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 11 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 6 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other SurrealDB technologies - [Surrealdb-Core](https://junglewise.ai/threats/technologies/surrealdb-core): 13 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Surrealdb vulnerabilities", https://junglewise.ai/threats/technologies/surrealdb-surrealdb, 12 November 2026.