CVE-2026-102876GHSA-vx2p-7hhm-wv62
SurrealDB before 3.3.0 Cross-Tenant Access via Headers
surrealdb surrealdb
CVSS
8.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.3.0surrealdbCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant's namespace and database to read, create, and modify records across tenant boundaries.
Text from CVE List
Affected versions 2
- surrealdbaffected: all versions before 3.3.0CVE List
- surrealdbunaffected: 3.3.0CVE List
References 6
- github.com/surrealdb/surrealdb/commit/5000e233b4a8b96689c82715c172061dcf711d31Fixvia CVE List
- github.com/surrealdb/surrealdb/releases/tag/v3.3.0Fixvia CVE List
- github.com/surrealdb/surrealdb/security/advisories/GHSA-vx2p-7hhm-wv62Advisoryvia CVE List
- vulncheck.com/advisories/surrealdb-before-3.3.0-cross-tenant-access-via-headersAdvisoryvia CVE List
- github.com/surrealdb/surrealdb/blob/v3.2.4/surrealdb/server/src/ntw/auth.rsReferencevia CVE List
- github.com/surrealdb/surrealdbReferencevia CVE List