CVE-2026-63757High· 8.8▾ TwilightSurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.5%
The HTTP /rpc sessions method returned every attached session UUID without authentication, and the /rpc handler accepted an arbitrary session field with no ownership check. An anonymous caller could enumerate UUIDs and impersonate any authenticated session.
"Attached" means sessions registered via {"method":"attach"} — the only writer to the HTTP session map. Ordinary stateless /rpc requests use ephemeral per-request sessions that are filtered from sessions() and destroyed at end-of-request, so they are not enumerable.
attach, notably the official Rust SDK's Http/Https engine (auto-attaches once per Surreal handle)./sql, /key, /signin, /export, etc.); WebSocket /rpc (per-connection scope, attach refused); embedded / MCP usage; ad-hoc POST /rpc callers that never attach.For each attached and authenticated session, an unauthenticated attacker can read, write, and delete any data the session can reach, dump metadata, invalidate sessions, and escalate to that session's privilege level (up to root). An attached session that has not yet authenticated is Level::No and confers no privilege.
sessions() now returns method_not_allowed. WebSocket retains per-connection enumeration./rpc handler gates client-supplied session IDs against the caller's request-level auth principal (actor id + level); mismatches return session_not_found.SURREAL_HTTP_MAX_ATTACHED_SESSIONS.Versions 3.1.0 and later are not affected.
No configuration-level mitigation fully addresses this. For Users unable to upgrade:
attach against HTTP /rpc (notably the Rust SDK's Http/Https engine). Prefer the WebSocket transport, or REST endpoints (/sql, /signin, /key, /export) which never populate the attached-session map./rpc to trusted clients at the network layer.surrealdb < 3.1.0Upgrade to a patched release:
surrealdb 3.1.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63756High· 8.1SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation
GHSA-5qfp-32cf-69jhHigh· 8.8SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers
CVE-2026-63741Medium· 6.5SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization
CVE-2026-63759Medium· 6.5SurrealDB vulnerable to Denial of Service due to nested types annotations
CVE-2026-63747High· 7.5SurrealDB has unauthenticated remote DoS via malformed RPC `use` call
CVE-2026-63744Medium· 4.1SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch