SurrealDB vulnerabilities

Privilege escalation vulnerability in SurrealDB before 2.5.0 and 3.0.0-beta.3. Unprivileged users can create or modify fields containing futures, functions, or closures that execute in the context of a privileged user, leading to privilege escalation up to server takeover.

SurrealDB before version 2.6.1 (and before 3.0.0-beta.3) contains a denial of service vulnerability in the JavaScript engine. A user able to execute queries can construct a large string and pass it to compilation, causing a null pointer dereference and server crash.

SurrealDB before 3.1.0 silently substitutes ES512 with ES384 when JWT access is configured with ALGORITHM ES512, due to missing ES512 support in the jsonwebtoken crate v10.x. This causes curve mismatch (P-521 vs P-384) and authentication failures. The flaw cannot be used to forge tokens or compromise data confidentiality.

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.

SurrealDB before version 3.1.0 fails to enforce recursion depth limits in the type/kind parser. Authenticated attackers can send queries with deeply nested type annotations, exhausting server memory and crashing the process.

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement, allowing authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions without ownership verification.

Vulnerability in SurrealDB before version 3.1.0. The HTTP /rpc sessions method returns session UUIDs without authentication and accepts arbitrary session fields without ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.

Time-of-check/time-of-use race condition in SurrealDB before version 3.1.0 in the HTTP /rpc endpoint. Unauthenticated requests can inherit authenticated session state, allowing privilege hijacking.

SurrealDB before version 3.1.0 evaluates user-supplied WHERE clauses before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An authenticated user can read the full contents of any table in the database, bypassing table-level permission checks. The vulnerability is confined to the current database.

In SurrealDB before 3.1.0, malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with select-only permissions can block writes for any user, including root.

Vulnerability in SurrealDB before version 3.1.0. Authentication state is not refreshed in LIVE SELECT subscriptions after session changes. Attackers can continue receiving real-time notifications after session expiry or revocation.

SurrealDB before version 3.1.0 contains an authorization bypass vulnerability in the RELATE statement. Authenticated users with CREATE permission can overwrite existing edge records without UPDATE permission by using a SET id clause pointing to an existing edge id.

SurrealDB before version 3.1.0 contains a field-level permission bypass vulnerability in JSON Patch operations. Authenticated users can read protected fields by using UPDATE PATCH with an empty from pointer in copy or move operations, duplicating all record fields including those restricted by field-level SELECT permissions.

In SurrealDB before 3.1.0, the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit is not applied to anonymous /sql WebSocket connections. Attackers can stream oversized frames across multiple connections to consume excessive memory and degrade /sql availability.

SurrealDB before version 3.1.0 contains an authentication bypass vulnerability in LIVE SELECT subscriptions. Permission expressions referencing $value, $before, $after, or $event are evaluated against attacker-controlled bindings instead of actual documents. Authenticated subscribers can register LIVE SELECT queries to receive notifications for records that should be hidden.

SurrealDB before 3.1.0 discloses field values hidden by field-level SELECT permissions through error messages. Attackers with UPDATE access can trigger arithmetic operations on hidden fields, leaking values in error responses.

Denial of service vulnerability in SurrealDB before version 3.1.0, in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process.

SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause.

SurrealDB before version 3.1.0 contains an authorization bypass vulnerability allowing authenticated users to spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-named body fields to spoofed values that permission checks incorrectly read instead of the immutable id key.

SurrealDB before version 3.1.5 contains a server-side request forgery (SSRF) vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targets against network capabilities. Attackers with Owner role can configure a JWKS URL pointing to an allowlisted host that redirects to blocked internal addresses, bypassing network access controls.

SurrealDB before version 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-net rules. Attackers can chain an HTTP redirect from an allowed hostname to a denied host:port combination, and the redirect is followed because the port information is dropped during redirect policy evaluation.

SurrealDB before version 3.1.0 contains a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths. Attackers can execute COUNT queries on indexed fields with field-level SELECT restrictions to confirm or recover restricted field values through repeated guesses.

Vulnerability in SurrealDB before version 3.1.0. The system fails to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can create arbitrary namespaces and databases, bypassing authorization checks.

SurrealDB before version 3.1.4 fails to properly enforce SELECT permissions on array elements (field.*) for record users. Attackers with record scope access can read array elements that should be hidden by element-level permissions.

Vulnerability in SurrealDB before 3.1.5 in the DEFINE ANALYZER mapper filter allows arbitrary file read. Users with EDITOR or OWNER roles can read files accessible to the SurrealDB process by specifying paths in the filter and retrieving content via error messages when SURREAL_FILE_ALLOWLIST is empty or unconfigured.

SurrealDB versions 3.1.0 through 3.1.5 fail to enforce field-level SELECT permissions when accessed via graph-edge traversals. Attackers with table-level SELECT can read hidden fields by materializing records through graph navigation.

A vulnerability in SurrealDB before version 3.1.5 allows authenticated users to perform a denial of service (DoS) attack by submitting queries with long chains of operators. This causes a stack overflow during query processing and crashes the server.

SurrealDB before 3.2.0 has a server-side request forgery vulnerability in the JWKS fetcher. It validates only the URL hostname string against allow-lists without checking resolved IP addresses, allowing an Owner role attacker to direct requests to internal addresses.

Vulnerability in SurrealDB before version 3.2.0 allows authenticated users to access custom API endpoints in other namespaces/databases, potentially leading to reading sensitive data or unauthorized operations.

DoS vulnerability in SurrealDB before version 3.2.0. The SurrealML header parser does not validate input, allowing authenticated Owner-role users to upload a malformed .surml file to the /ml/import endpoint. Invalid values (e.g., non-numeric input-dimensions) cause a panic that crashes the entire server.

SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, causing unintended writes and data corruption.

SurrealDB before version 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers can host a public server that redirects to internal resources.

Vulnerability in SurrealDB before versions 2.0.5, 2.1.5, and 2.2.2. Authenticated users with OWNER or EDITOR permissions can define database functions with nested FOR loops, potentially exhausting CPU and rendering the server unresponsive.

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when scripting is explicitly enabled. An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default.

Memory exhaustion vulnerability in SurrealDB before version 2.2.2 in the string::replace function that fails to restrict resulting string length when using regex patterns. An authenticated attacker can craft a malicious query to exhaust server memory, causing denial of service.

Vulnerability in SurrealDB before version 2.2.2 in the DEFINE ANALYZER statement allows authenticated users to read arbitrary local files. Attackers with root, namespace, or database privileges can point analyzers to arbitrary file paths and exfiltrate content from two-column tab-separated files.

SurrealDB before version 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory.

SurrealDB before versions 2.0.5, 2.1.5, and 2.2.2 fails to properly escape table and field names in the CLI export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious SurrealQL names; when a higher-privileged user imports the backup, the injected code executes, enabling privilege escalation and root-level takeover.

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instance and any dependent applications.

SurrealDB before versions 2.2.6, 2.3.6, 2.1.8, and 3.0.0-alpha.7 fails to validate DNS-resolved hostnames against deny-net restrictions in http::* functions. An authenticated user can use a hostname that resolves to a blocked IP, bypassing access controls.

SurrealDB before version 1.1.0 fails to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idioms. Authorized attackers can submit queries with excessive nesting depth to cause stack overflow and crash the server.

SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing server panic. Authorized clients can invoke these entities at unsupported levels to crash the SurrealDB server, resulting in denial of service.

Vulnerability in SurrealDB before version 1.1.0. Improper parsing of ID, DB, and NS headers in HTTP REST API requests with special characters. Unauthenticated attacker can send crafted HTTP requests causing an uncaught exception that crashes the server.

Vulnerability in SurrealDB before version 2.0.4. Field permissions are not enforced during SELECT, UPDATE, and DELETE operations. An authenticated user can access field values they lack permission for using techniques like SELECT VALUE, field aliasing, functions, WHERE clause, RETURN BEFORE, and SET.

SurrealDB before version 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs.

SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed queries invoking nonexistent functions to trigger a panic that crashes the server.

SurrealDB before version 1.2.1 contains an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can submit malformed queries that trigger a panic and crash the server.

SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.

Vulnerability in SurrealDB before version 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) in the RPC API. An unauthenticated attacker can supply a binary object with a subquery in place of credentials, leading to execution of the subquery in the context of the database owner with editor role.

SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error rendering, crashing the server.