Skip to content
CVE PROGRAM SOURCE RECORD9.2 Critical

CVE-2026-63756

SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated session state. Unauthenticated attackers can send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active to execute operations with hijacked user privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

surrealdb surrealdb

Default version status: unaffected

  • 0 to < 3.1.0affected
  • 3.1.0unaffected
pkg:cargo/surrealdb

References