CVE-2023-54366: SurrealDB Auth Bypass Vulnerability

CVE-2023-54366 Overview

CVE-2023-54366 is an insecure default configuration vulnerability in SurrealDB versions before 1.0.1. The database engine sets default table permissions to FULL instead of NONE, granting SELECT, CREATE, UPDATE, and DELETE operations on any table lacking explicit permission definitions. Attackers with authenticated database access, and unauthenticated users on publicly exposed instances, can perform unrestricted operations on unprotected tables within their authorization scope. The flaw maps to CWE-276: Incorrect Default Permissions.

Critical Impact
Unrestricted read and write access to tables without explicit permission rules, resulting in data confidentiality, integrity, and availability compromise.

Affected Products

SurrealDB versions prior to 1.0.1
Deployments relying on default schema-less table creation
Publicly exposed SurrealDB instances without namespace-level access controls

Discovery Timeline

2026-07-18 - CVE-2023-54366 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2023-54366

Vulnerability Analysis

SurrealDB implements a per-table permissions model that defines who can perform SELECT, CREATE, UPDATE, and DELETE operations. When a table is created without an explicit PERMISSIONS clause, the engine should apply a least-privilege default. In versions before 1.0.1, the default is FULL, which permits all operations for any principal that reaches the table within its authorization scope.

The vulnerability affects both authenticated and unauthenticated deployment models. Authenticated users with scoped access can operate on tables never intended to be exposed to them. Instances reachable over the network without authentication permit direct data manipulation by any client.

Exploitation requires no specialized tooling. An attacker connects using the SurrealDB client, WebSocket interface, or HTTP API and issues standard SurrealQL statements against the target table.

Root Cause

The root cause is an insecure-by-default policy [CWE-276]. The engine treated the absence of a PERMISSIONS clause as authorization to grant FULL access rather than defaulting to NONE and requiring explicit grants. Version 1.0.1 inverts this default so tables without explicit permissions deny operations.

Attack Vector

The attack vector is network-based with low complexity. An attacker with valid low-privilege credentials, or any network client against an unauthenticated instance, submits SurrealQL queries such as SELECT * FROM <table>, CREATE <table> SET ..., UPDATE <table> SET ..., or DELETE <table>. Because the default permission is FULL, the engine executes the operation without evaluating record-level or role-based restrictions.

Exploitation of this vulnerability requires no code injection, memory corruption, or protocol manipulation. It relies solely on the misconfigured default.

Detection Methods for CVE-2023-54366

Indicators of Compromise

Unexpected CREATE, UPDATE, or DELETE statements in SurrealDB query logs targeting tables that should be read-only or restricted
Anomalous connections to SurrealDB ports (default 8000) from untrusted networks or unknown client IP addresses
Table definitions that lack an explicit PERMISSIONS FOR select, create, update, delete clause
Sudden growth or truncation of tables that are not part of application write paths

Detection Strategies

Audit each namespace and database with INFO FOR DB and INFO FOR TABLE <name> to enumerate tables whose permission definitions are missing or set to FULL
Enable and centralize SurrealDB query logs, then alert on write operations from accounts scoped only to read workflows
Correlate authentication events with subsequent SurrealQL statements to identify low-privilege sessions performing broad table operations

Monitoring Recommendations

Ship SurrealDB access and query telemetry to a centralized logging or SIEM platform for long-term retention and correlation
Baseline normal SurrealQL statement patterns per service account and alert on deviations in verbs, tables touched, or record counts
Monitor network exposure of SurrealDB endpoints and flag any instance reachable from the public internet without authentication

How to Mitigate CVE-2023-54366

Immediate Actions Required

Upgrade SurrealDB to version 1.0.1 or later, where the default table permission is NONE
Enumerate existing tables and add explicit PERMISSIONS clauses that reflect least privilege for each principal
Restrict network exposure of SurrealDB instances to trusted application tiers and require authentication on all connections
Rotate any credentials that may have been exposed to unauthorized clients while the default FULL policy was in effect

Patch Information

The issue is fixed in SurrealDB 1.0.1. Details are available in the GitHub Security Advisory GHSA-x5fr-7hhj-34j3 and the VulnCheck Security Advisory. Upgrading applies the corrected default and does not modify existing explicit permission definitions.

Workarounds

Define PERMISSIONS FOR select, create, update, delete NONE on every table that does not require broad access, then grant specific permissions as needed
Place SurrealDB behind a network policy or firewall that restricts access to application servers only
Disable unauthenticated access by requiring root, namespace, or database credentials on every connection

bash

# Define least-privilege permissions on a SurrealDB table
DEFINE TABLE account SCHEMAFULL
  PERMISSIONS
    FOR select WHERE user = $auth.id
    FOR create, update, delete NONE;