CVE-2024-58356: SurrealDB Auth Bypass Vulnerability

CVE-2024-58356 Overview

CVE-2024-58356 affects SurrealDB versions prior to 2.1.4. The database silently fails to apply new table definitions when administrators use the DEFINE TABLE ... OVERWRITE clause on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an administrator attempting to tighten access controls receives no error, but the update never takes effect. Clients previously authorized to query the table retain their original access to data the administrator believed had been restricted. The vulnerability is classified as [CWE-276] Incorrect Default Permissions.

Critical Impact
Administrators may operate under the false assumption that permission changes to TYPE RELATION tables have been applied, allowing continued unauthorized read or write access to relational data.

Affected Products

SurrealDB versions prior to 2.1.4
Deployments using TYPE RELATION table definitions
Environments relying on DEFINE TABLE ... OVERWRITE for permission updates

Discovery Timeline

2026-07-18 - CVE-2024-58356 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2024-58356

Vulnerability Analysis

SurrealDB supports two primary table categories: standard tables and relation tables declared with TYPE RELATION. Table schema, including the PERMISSIONS clause governing row-level access, can be updated in place using the DEFINE TABLE ... OVERWRITE statement. On vulnerable versions, this statement silently no-ops when the target is a relation table.

The database returns a success response, and the administrator observes no error. However, the previous table definition remains in force. Existing session tokens and query permissions continue to reflect the outdated policy. This creates a persistent authorization drift between the intended and enforced policy state.

The issue is limited in scope because exploitation requires a prior administrator misconfiguration attempt. It does not grant an attacker new access beyond what was already permitted before the failed update. Nonetheless, the confidentiality, integrity, and availability of restricted relational data may be compromised for the duration the outdated permissions remain in effect.

Root Cause

The root cause lies in the code path handling DEFINE TABLE OVERWRITE for tables with TYPE RELATION. The logic responsible for replacing an existing definition does not process the relation-table branch, so the incoming definition, including the updated PERMISSIONS clause, is discarded without an error signal to the caller.

Attack Vector

The vulnerability is not directly exploitable by an unauthenticated attacker. Exploitation is passive: an authenticated user with existing query rights on a TYPE RELATION table continues to access data after the administrator believes access was revoked. The attack vector is network-based, and the attacker requires low privileges to query the affected table.

The vulnerability manifests entirely within SurrealDB's schema management logic. See the GitHub Security Advisory GHSA-27vq-hv74-7cqp for maintainer-provided technical detail.

Detection Methods for CVE-2024-58356

Indicators of Compromise

Query logs showing successful access to TYPE RELATION tables by principals that administrators expected to be restricted.
Audit records containing DEFINE TABLE ... OVERWRITE statements executed against relation tables on SurrealDB versions below 2.1.4.
Discrepancies between intended PERMISSIONS clauses in configuration-as-code and the definitions returned by INFO FOR TABLE.

Detection Strategies

Compare the output of INFO FOR DB and INFO FOR TABLE against the expected permission policy stored in version control.
Replay any DEFINE TABLE OVERWRITE statements targeting relation tables in a controlled environment and verify that the resulting PERMISSIONS clause matches the intended policy.
Alert when authenticated queries succeed against relation tables whose permissions were recently updated on a vulnerable version.

Monitoring Recommendations

Ingest SurrealDB query and schema-change logs into a centralized data lake for correlation with administrative activity.
Track SurrealDB version inventory and flag any instance running a release earlier than 2.1.4.
Monitor for anomalous read volume from service accounts that continue to access relation tables after documented policy tightening.

How to Mitigate CVE-2024-58356

Immediate Actions Required

Upgrade SurrealDB to version 2.1.4 or later on every node in the cluster.
Audit all TYPE RELATION tables and re-apply the intended PERMISSIONS clause after upgrade, verifying with INFO FOR TABLE.
Revoke and reissue tokens or credentials for principals that may have retained unintended access.

Patch Information

The issue is resolved in SurrealDB 2.1.4. Consult the GitHub Security Advisory and the VulnCheck Advisory for release details and version references.

Workarounds

Drop and recreate affected TYPE RELATION tables using REMOVE TABLE followed by DEFINE TABLE instead of OVERWRITE, accepting the operational cost of table recreation.
Restrict administrative access so that only reviewed change-management pipelines can execute DEFINE TABLE statements, and verify the resulting schema after each change.
Enforce least-privilege authorization at the application tier as a compensating control until all nodes are patched.

bash

# Verify SurrealDB version and inspect the applied permissions on a relation table
surreal version
surreal sql --endpoint http://127.0.0.1:8000 --username root --password <redacted> \
  --namespace myns --database mydb \
  --pretty <<'SQL'
INFO FOR TABLE my_relation_table;
SQL