{"id":"CVE-2026-63741","aliases":["GHSA-wp87-mgvq-5j93"],"title":"SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization","summary":"SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","vendor":"surrealdb","product":"surrealdb","ecosystem":"rust","affected":["surrealdb < 3.1.0"],"patched":["surrealdb 3.1.0"],"published":"2026-07-01","updated":"2026-11-04","sourceUpdated":"2026-11-04T02:56:04.528727968Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-wp87-mgvq-5j93","references":[{"url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-wp87-mgvq-5j93"},{"url":"https://github.com/surrealdb/surrealdb/commit/f3ee3bd55533c14f1fa3e69ce18fc8904c1ce3f9"},{"url":"https://github.com/surrealdb/surrealdb"}],"tags":["osv","rust"],"epss":0.00369,"epssPercentile":0.30967,"ingestedAt":"2026-11-04T19:09:49.106Z","slug":"CVE-2026-63741","body":"## Overview\n\nAn anonymous caller could create new namespaces and databases on a running SurrealDB instance without holding `DEFINE NAMESPACE` or `DEFINE DATABASE` permission.\n\n`USE NS <name>` and `USE DB <name>` automatically create the target when it does not exist. The three places `USE` is handled — the RPC `use` method, `Datastore::process_use`, and the SurrealQL executor — did not check whether the caller was allowed to create the resource. Under default capabilities any session reached this path, including an unauthenticated guest.\n\n### Impact\n\nWhat an attacker **can** do:\n\n- Create new namespaces and databases without `DEFINE NAMESPACE` / `DEFINE DATABASE` permission. An unauthenticated guest is enough under default capabilities.\n- Recreate a parent namespace that an operator deliberately dropped, using a stale namespace-Editor token, by running `USE NS <dropped> DB anything`.\n- Exhaust catalog storage by repeatedly creating new resources.\n\nWhat it **can't** do:\n\n- Read or modify data inside any pre-existing namespace or database.\n- Escalate to root or namespace-owner privileges on existing resources.\n- Affect deployments running with `auth_enabled=false`.\n\n### Patches\n\nAll three `USE` entry points now check whether the caller has `DEFINE NAMESPACE` / `DEFINE DATABASE` authority before creating a missing target. Sessions still update their context regardless of authorization, so SDKs that send `use` before `signin` continue to work — only the catalog creation step is gated. The parent-namespace side-effect path is closed by the same check.\n\nVersions 3.1.0 and later are not affected.\n\n### Workarounds\n\n- Set `--deny-arbitrary-query *` for guest principals to remove the entry point.\n- Run with `--auth` and require all callers to `signin` before issuing `use`.\n- Revoke namespace-level tokens promptly when a namespace is dropped.\n\n## Affected packages\n\n- `surrealdb < 3.1.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `surrealdb 3.1.0`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}