Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions

Summary

A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.

Timeline

1. Sep 26, 2025, 12:01 PM UTCCVE published
2. Sep 26, 2025, 1:04 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Nov 7, 2025, 7:42 PM UTCRecord last updated

Affected versions

• surrealdb

  fixed in 2.1.9; From 2.2.0 · fixed in 2.2.8; From 2.3.0 · fixed in 2.3.8; From 3.3.0 · fixed in 3.3.0-alpha.7

• openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9

  Version range not reported

• openshift-service-mesh/istio-cni-rhel9

  Version range not reported

• openshift-service-mesh/istio-must-gather-rhel9

  Version range not reported

• openshift-service-mesh/istio-pilot-rhel9

  Version range not reported

• openshift-service-mesh/istio-proxyv2-rhel9

  Version range not reported

• openshift-service-mesh/istio-rhel9-operator

  Version range not reported

• openshift-service-mesh/istio-sail-operator-bundle

  Version range not reported

• openshift-service-mesh-tech-preview/istio-ztunnel-rhel9

  Version range not reported

• SurrealDBcrates.io

  From 2.3.0 · fixed in 2.3.8

• SurrealDBcrates.io

  From 2.2.0 · fixed in 2.2.8

• SurrealDBcrates.io

  fixed in 2.1.9

• SurrealDBcrates.io

  From 3.0.0-alpha.0 · fixed in 3.0.0-alpha.8

References 7