Surrealdb vulnerabilities
77 CVEs and advisories name Surrealdb as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-121423SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization
- CVE-2026-121422SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass
- CVE-2026-121421SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass
- CVE-2026-121420SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses
- CVE-2026-121419SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision
- CVE-2026-121418SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner
- CVE-2026-121417SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends
- CVE-2026-121416SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations
- CVE-2026-109343SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement
- CVE-2026-109342SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method
- CVE-2026-109341SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations
- CVE-2026-109340SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE
- CVE-2026-109339SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering
- CVE-2026-109338SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values
- CVE-2026-109337SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause
- CVE-2026-109336SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after
- CVE-2026-109335SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields
- CVE-2026-109334SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use
- CVE-2026-109333SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH
- CVE-2026-102876SurrealDB before 3.3.0 Cross-Tenant Access via Headers
- CVE-2026-63763SurrealDB before 2.5.0 Privilege Escalation via Future Fields
- CVE-2026-63762SurrealDB before v2.6.1 Denial of Service via scripting
- CVE-2026-63761SurrealDB before 3.1.0 Algorithm Downgrade via ES512
- CVE-2026-63760SurrealDB before 3.1.0 Denial of Service via JSON Parser
- CVE-2026-63759SurrealDB before 3.1.0 Denial of Service nested type annotations
- CVE-2026-63758SurrealDB before 3.1.0 Authorization Bypass via KILL Statement
- CVE-2026-63757SurrealDB before 3.1.0 Session Hijacking via /rpc sessions
- CVE-2026-63756SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition
- CVE-2026-63755SurrealDB before 3.1.0 Permission Bypass via WHERE Clause
- CVE-2026-63754SurrealDB before 3.1.0 Denial of Service via LIVE Query