surrealdb has 79 CVEs on record. Disclosures have slowed: 15 in the last 90 days after 63 in the 90 before. The busiest recent month was July 2026 with 53. The median CVSS is 6.5 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-863 (14) and CWE-639 (6).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 15 prev 63
Weakness classes
Products
- surrealdb 79
Worst active — by depth score
CVE-2026-63757High· 8.8SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers49CVE-2025-71390High· 8.8SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions48GHSA-5qfp-32cf-69jhHigh· 8.8SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers48CVE-2024-58366High· 8.5SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled47CVE-2026-109343High· 8.1SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it45
surrealdb vulnerabilities
CVEs affecting surrealdb, newest first. Open any entry for full detail, references, and exploit status.
79 CVEsRSS
CVE-2024-58366High· 8.5SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled
SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitr…
CVE-2024-58363Medium· 6.3SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method
SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database i…
CVE-2026-63741Medium· 6.5SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization
SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization
CVE-2026-63759Medium· 6.5SurrealDB vulnerable to Denial of Service due to nested types annotations
SurrealDB vulnerable to Denial of Service due to nested types annotations
CVE-2026-63747High· 7.5SurrealDB has unauthenticated remote DoS via malformed RPC `use` call
SurrealDB has unauthenticated remote DoS via malformed RPC `use` call
CVE-2026-63749Medium· 4.3SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions
SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions
CVE-2026-63742Medium· 4.3SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths
SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths
CVE-2026-63757High· 8.8SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers
SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers
CVE-2026-63750Medium· 5.3SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames
SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames
CVE-2026-63756High· 8.1SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation
SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation
CVE-2026-63754Medium· 6.5SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required
SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required
CVE-2026-63753Medium· 4.3SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controls
SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controls
CVE-2026-63752Medium· 4.3SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission
SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission
CVE-2026-63760High· 7.5SurrealDB has Denial of Service in JSON parser due to nested objects
SurrealDB has Denial of Service in JSON parser due to nested objects
CVE-2026-63758Medium· 5.4SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries
SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries
CVE-2026-63743Medium· 6.4SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect
SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect
CVE-2026-63748Medium· 4.3SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages
SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages
GHSA-6g9v-7gq3-p2c6Medium· 4.3SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages
SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages
GHSA-fpxg-5xmv-922mMedium· 4.3SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`
SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`
GHSA-f82j-v89j-mf86Medium· 4.3SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission
SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission
GHSA-6wqw-vhfr-9999Medium· 4.3SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions
SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions
GHSA-97vg-427p-8hx5Medium· 6.4SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect
SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect
GHSA-wp87-mgvq-5j93Medium· 6.5SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization
SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization
GHSA-c8jx-96c9-8xrpMedium· 4.3SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths
SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths
GHSA-fwg2-gr34-q3w8Medium· 4.3SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation
SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation
CVE-2026-49997Medium· 5.4SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted
SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted
GHSA-5qfp-32cf-69jhHigh· 8.8SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers
SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers
GHSA-4vgr-h27g-cf9pHigh· 8.1SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation
SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation
GHSA-q729-696q-g9pqHigh· 7.5SurrealDB has Denial of Service in JSON parser due to nested objects
SurrealDB has Denial of Service in JSON parser due to nested objects
GHSA-wjjj-24cx-f28gHigh· 7.5SurrealDB has unauthenticated remote DoS via malformed RPC `use` call
SurrealDB has unauthenticated remote DoS via malformed RPC `use` call