{"id":"CVE-2026-121419","title":"SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision","summary":"SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privile…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-269"],"vendor":"surrealdb","product":"surrealdb","affected":["surrealdb >= 3.1.0 < 3.3.0"],"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T14:28:16.612Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121419","references":[{"url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pgh9-49q4-hqcx","label":"GitHub Security Advisory (GHSA-pgh9-49q4-hqcx)"},{"url":"https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-mcp-session-hijack-via-boundsubject-collision","label":"VulnCheck Advisory: SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision"}],"tags":["cve.org"],"epss":0.00319,"epssPercentile":0.24986,"ingestedAt":"2026-11-05T19:30:42.967Z","slug":"CVE-2026-121419","body":"## Overview\n\nSurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's mcp-session-id can hijack the session and execute MCP tools with the victim's roles and permissions.\n\n## Affected\n\n- `surrealdb >= 3.1.0 < 3.3.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}