CVE-2026-109343GHSA-2v9j-645m-pcrq
SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement
surrealdb surrealdb
CVSS
8.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.3.0surrealdbCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch to another tenant and read, create, update, or delete rows in tables whose PERMISSIONS allow it, such as PERMISSIONS FULL.
Text from CVE List
Affected versions 2
- surrealdbaffected: all versions before 3.3.0CVE List
- surrealdbunaffected: 3.3.0CVE List