CVE-2026-109334
SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level…
- Risk score
- 52/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 12 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method to read, create, modi…
- Affected
- See advisory
- Fix
- Upgrade the product to 3.3.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.1 high
References
Original description
SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method to read, create, modify, and delete rows and read DEFINE PARAM values in another tenant where table PERMISSIONS allow it.
Last activity 12 Oct 2026. Patch Forecast updates every hour.