# cve.now: Surrealdb

The newest entries naming Surrealdb as an affected vendor (up to 200), of 77 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121423](https://cve.now/CVE-2026-121423.md): SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization (CVSS 7.1)
- [CVE-2026-121422](https://cve.now/CVE-2026-121422.md): SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass (CVSS 5.1)
- [CVE-2026-121421](https://cve.now/CVE-2026-121421.md): SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass (CVSS 5.3)
- [CVE-2026-121420](https://cve.now/CVE-2026-121420.md): SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses (CVSS 4.8)
- [CVE-2026-121419](https://cve.now/CVE-2026-121419.md): SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision (CVSS 8.6)
- [CVE-2026-121418](https://cve.now/CVE-2026-121418.md): SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner (CVSS 5.3)
- [CVE-2026-121417](https://cve.now/CVE-2026-121417.md): SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn\_local in KV Backends (CVSS 8.8)
- [CVE-2026-121416](https://cve.now/CVE-2026-121416.md): SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations (CVSS 7.1)
- [CVE-2026-109343](https://cve.now/CVE-2026-109343.md): SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement (CVSS 8.6)
- [CVE-2026-109342](https://cve.now/CVE-2026-109342.md): SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method (CVSS 5.3)
- [CVE-2026-109341](https://cve.now/CVE-2026-109341.md): SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations (CVSS 7.1)
- [CVE-2026-109340](https://cve.now/CVE-2026-109340.md): SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE (CVSS 5.3)
- [CVE-2026-109339](https://cve.now/CVE-2026-109339.md): SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering (CVSS 6.9)
- [CVE-2026-109338](https://cve.now/CVE-2026-109338.md): SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values (CVSS 7.1)
- [CVE-2026-109337](https://cve.now/CVE-2026-109337.md): SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause (CVSS 5.3)
- [CVE-2026-109336](https://cve.now/CVE-2026-109336.md): SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after (CVSS 5.3)
- [CVE-2026-109335](https://cve.now/CVE-2026-109335.md): SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields (CVSS 7.1)
- [CVE-2026-109334](https://cve.now/CVE-2026-109334.md): SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use (CVSS 8.6)
- [CVE-2026-109333](https://cve.now/CVE-2026-109333.md): SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH (CVSS 7.1)
- [CVE-2026-102876](https://cve.now/CVE-2026-102876.md): SurrealDB before 3.3.0 Cross-Tenant Access via Headers (CVSS 8.6)
- [CVE-2026-63763](https://cve.now/CVE-2026-63763.md): SurrealDB before 2.5.0 Privilege Escalation via Future Fields (CVSS 7.5)
- [CVE-2026-63762](https://cve.now/CVE-2026-63762.md): SurrealDB before v2.6.1 Denial of Service via scripting (CVSS 6.0)
- [CVE-2026-63761](https://cve.now/CVE-2026-63761.md): SurrealDB before 3.1.0 Algorithm Downgrade via ES512 (CVSS 5.3)
- [CVE-2026-63760](https://cve.now/CVE-2026-63760.md): SurrealDB before 3.1.0 Denial of Service via JSON Parser (CVSS 8.7)
- [CVE-2026-63759](https://cve.now/CVE-2026-63759.md): SurrealDB before 3.1.0 Denial of Service nested type annotations (CVSS 7.1)
- [CVE-2026-63758](https://cve.now/CVE-2026-63758.md): SurrealDB before 3.1.0 Authorization Bypass via KILL Statement (CVSS 5.3)
- [CVE-2026-63757](https://cve.now/CVE-2026-63757.md): SurrealDB before 3.1.0 Session Hijacking via /rpc sessions (CVSS 8.7)
- [CVE-2026-63756](https://cve.now/CVE-2026-63756.md): SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition (CVSS 9.2)
- [CVE-2026-63755](https://cve.now/CVE-2026-63755.md): SurrealDB before 3.1.0 Permission Bypass via WHERE Clause (CVSS 7.1)
- [CVE-2026-63754](https://cve.now/CVE-2026-63754.md): SurrealDB before 3.1.0 Denial of Service via LIVE Query (CVSS 7.1)
- [CVE-2026-63753](https://cve.now/CVE-2026-63753.md): SurrealDB before 3.1.0 Authentication Bypass via LIVE Query (CVSS 5.3)
- [CVE-2026-63752](https://cve.now/CVE-2026-63752.md): SurrealDB before 3.1.0 RELATE Statement Record Overwrite (CVSS 5.3)
- [CVE-2026-63751](https://cve.now/CVE-2026-63751.md): SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch (CVSS 5.3)
- [CVE-2026-63750](https://cve.now/CVE-2026-63750.md): SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket (CVSS 6.9)
- [CVE-2026-63749](https://cve.now/CVE-2026-63749.md): SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT (CVSS 5.3)
- [CVE-2026-63748](https://cve.now/CVE-2026-63748.md): SurrealDB before 3.1.0 Information Disclosure via Error Messages (CVSS 5.3)
- [CVE-2026-63747](https://cve.now/CVE-2026-63747.md): SurrealDB before 3.1.0 Denial of Service via malformed RPC use (CVSS 8.7)
- [CVE-2026-63746](https://cve.now/CVE-2026-63746.md): SurrealDB before 3.1.0 Permission Bypass via Graph Traversal (CVSS 7.1)
- [CVE-2026-63745](https://cve.now/CVE-2026-63745.md): SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id (CVSS 5.3)
- [CVE-2026-63744](https://cve.now/CVE-2026-63744.md): SurrealDB before 3.1.5 SSRF via JWKS URL Redirect (CVSS 5.1)
- [CVE-2026-63743](https://cve.now/CVE-2026-63743.md): SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirect (CVSS 5.3)
- [CVE-2026-63742](https://cve.now/CVE-2026-63742.md): SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNT (CVSS 5.3)
- [CVE-2026-63741](https://cve.now/CVE-2026-63741.md): SurrealDB before 3.1.0 Authentication Bypass via USE statement (CVSS 6.9)
- [CVE-2026-63740](https://cve.now/CVE-2026-63740.md): SurrealDB before 3.1.4 Array Element Permission Bypass (CVSS 7.1)
- [CVE-2026-63739](https://cve.now/CVE-2026-63739.md): SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER (CVSS 8.3)
- [CVE-2026-63738](https://cve.now/CVE-2026-63738.md): SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversal (CVSS 5.3)
- [CVE-2026-63737](https://cve.now/CVE-2026-63737.md): SurrealDB before 3.1.5 Denial of Service via deep operator chains (CVSS 7.1)
- [CVE-2026-63736](https://cve.now/CVE-2026-63736.md): SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution (CVSS 5.1)
- [CVE-2026-63735](https://cve.now/CVE-2026-63735.md): SurrealDB before 3.2.0 Authentication Bypass via Custom API (CVSS 8.6)
- [CVE-2026-63734](https://cve.now/CVE-2026-63734.md): SurrealDB before 3.2.0 Denial of Service via malformed SurrealML import (CVSS 6.9)
- [CVE-2026-63733](https://cve.now/CVE-2026-63733.md): SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clause (CVSS 5.3)
- [CVE-2025-71398](https://cve.now/CVE-2025-71398.md): SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypass (CVSS 5.8)
- [CVE-2025-71397](https://cve.now/CVE-2025-71397.md): SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops (CVSS 7.1)
- [CVE-2025-71396](https://cve.now/CVE-2025-71396.md): SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting (CVSS 2.3)
- [CVE-2025-71395](https://cve.now/CVE-2025-71395.md): SurrealDB before 2.2.2 Memory Exhaustion via string::replace (CVSS 7.1)
- [CVE-2025-71394](https://cve.now/CVE-2025-71394.md): SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER (CVSS 2.3)
- [CVE-2025-71393](https://cve.now/CVE-2025-71393.md): SurrealDB before 2.2.2 Memory Exhaustion via Nested Functions (CVSS 6.0)
- [CVE-2025-71392](https://cve.now/CVE-2025-71392.md): SurrealDB before 2.2.2 SurrealQL Injection via export (CVSS 9.4)
- [CVE-2025-71391](https://cve.now/CVE-2025-71391.md): SurrealDB before 2.2.2 Denial of Service via /sql endpoint (CVSS 7.1)
- [CVE-2025-71390](https://cve.now/CVE-2025-71390.md): SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution (CVSS 5.8)
- [CVE-2024-58370](https://cve.now/CVE-2024-58370.md): SurrealDB before 1.1.0 Uncontrolled Recursion Denial of Service (CVSS 7.1)
- [CVE-2024-58369](https://cve.now/CVE-2024-58369.md): SurrealDB before 1.1.1 Denial of Service via Global Parameters (CVSS 7.1)
- [CVE-2024-58368](https://cve.now/CVE-2024-58368.md): SurrealDB before 1.1.0 Denial of Service via HTTP Headers (CVSS 8.7)
- [CVE-2024-58367](https://cve.now/CVE-2024-58367.md): SurrealDB before 2.0.4 Improper Authorization via SELECT Permissions (CVSS 7.1)
- [CVE-2024-58366](https://cve.now/CVE-2024-58366.md): SurrealDB before 1.1.1 Format String via Scripting Functions (CVSS 9.0)
- [CVE-2024-58365](https://cve.now/CVE-2024-58365.md): SurrealDB before 1.2.0 Denial of Service via Nonexistent Function (CVSS 7.1)
- [CVE-2024-58364](https://cve.now/CVE-2024-58364.md): SurrealDB before 1.2.1 Denial of Service via Parsing Error (CVSS 7.1)
- [CVE-2024-58363](https://cve.now/CVE-2024-58363.md): SurrealDB before 1.5.4 Authentication Bypass via Database Switch (CVSS 5.3)
- [CVE-2024-58362](https://cve.now/CVE-2024-58362.md): SurrealDB before 1.5.5 Query Injection via RPC API (CVSS 8.7)
- [CVE-2024-58361](https://cve.now/CVE-2024-58361.md): SurrealDB before 2.0.4 Denial of Service via Parser Exception (CVSS 7.1)
- [CVE-2024-58359](https://cve.now/CVE-2024-58359.md): SurrealDB before 2.1.0 Denial of Service via rand() Sorting (CVSS 7.1)
- [CVE-2024-58358](https://cve.now/CVE-2024-58358.md): SurrealDB before 2.1.0 Denial of Service via Nonexistent Role (CVSS 6.9)
- [CVE-2024-58357](https://cve.now/CVE-2024-58357.md): SurrealDB before 2.1.0 Denial of Service via rand::time() (CVSS 7.1)
- [CVE-2024-58356](https://cve.now/CVE-2024-58356.md): SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE (CVSS 2.3)
- [CVE-2023-54366](https://cve.now/CVE-2023-54366.md): SurrealDB before 1.0.1 Insecure Default Table Permissions (CVSS 8.7)
- [CVE-2026-63309](https://cve.now/CVE-2026-63309.md): SurrealDB \< 3.1.5 Information Disclosure via ORDER BY (CVSS 5.3)
- [CVE-2026-49997](https://cve.now/CVE-2026-49997.md): SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/surrealdb
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.