CVE-2026-121416
SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function…
- Risk score
- 43/100
- CVSS
- 7.1 v3.1
- Published
- 3 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax, e.g. [1,2].map() or …
- Affected
- See advisory
- Fix
- Upgrade the product to 3.3.1 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.1 high
References
Original description
SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax, e.g. [1,2].map() or $f.put()/$f.get() to write and read file bucket data despite file::* denials.
Last activity 3 Nov 2026. Patch Forecast updates every hour.