CVE-2024-58358: SurrealDB Role Conversion DoS Vulnerability

CVE-2024-58358 Overview

CVE-2024-58358 is a denial of service vulnerability in SurrealDB versions before 2.1.0. The flaw exists in the role conversion logic, where privileged owner-level users can define accounts assigned to nonexistent roles. When such a user attempts to sign in, the server triggers an uncaught panic and crashes. The issue is tracked under [CWE-248] (Uncaught Exception) and requires high privileges to exploit over the network.

Critical Impact
An authenticated owner-level user can crash the SurrealDB server process by signing in with an account assigned to a nonexistent role, disrupting database availability for all clients.

Affected Products

SurrealDB versions prior to 2.1.0
Deployments using role-based access control with owner-level accounts
Self-hosted and embedded SurrealDB instances exposed to authenticated users

Discovery Timeline

2026-07-18 - CVE-2024-58358 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2024-58358

Vulnerability Analysis

The vulnerability resides in SurrealDB's role conversion routine. When the server processes authentication for a user, it converts stored role identifiers into internal role objects. The conversion logic does not handle the case where the assigned role does not exist in the database. Instead of returning a structured error, the code path panics. Because SurrealDB does not catch this panic at the request boundary, the entire server process terminates. All active connections drop, and clients lose access until the service restarts.

The attack requires an existing owner-level account to create the malformed user record. However, once the user with the nonexistent role exists, any sign-in attempt against that account triggers the crash. This makes recovery difficult if the malicious record persists across restarts.

Root Cause

The root cause is missing validation during role assignment combined with an uncaught panic during role resolution. SurrealDB accepts DEFINE USER statements that reference roles without verifying the role exists. The authentication path later attempts to resolve the role and calls a fallible conversion that panics on the missing entry. See the GitHub Security Advisory for the specific code path.

Attack Vector

An attacker with owner privileges issues a DEFINE USER statement referencing a role name that has not been defined in the target namespace or database. Any subsequent sign-in attempt using that user's credentials triggers the panic. The vector is network-accessible and does not require user interaction beyond the sign-in call. The Vulncheck Advisory on SurrealDB documents the exploitation flow.

Detection Methods for CVE-2024-58358

Indicators of Compromise

Unexpected SurrealDB process termination with panic messages referencing role conversion in stderr or logs.
Presence of user definitions where the assigned role does not match any defined role in the namespace or database.
Repeated sign-in attempts from a single account immediately preceding server crashes.

Detection Strategies

Audit all DEFINE USER statements and cross-reference assigned roles against DEFINE ROLE entries to identify orphaned references.
Enable panic and crash logging on the SurrealDB host and forward stack traces to a central log platform for correlation.
Monitor for abnormal restart frequency of the SurrealDB service, which indicates repeated crash-and-recover cycles.

Monitoring Recommendations

Alert on any SurrealDB process exit that is not the result of a controlled shutdown command.
Track creation of new users by owner-level accounts and flag those referencing undefined roles.
Correlate authentication failures and sign-in attempts with subsequent service availability drops.

How to Mitigate CVE-2024-58358

Immediate Actions Required

Upgrade SurrealDB to version 2.1.0 or later, which contains the fix for the role conversion panic.
Review the user table and remove or reassign any accounts referencing nonexistent roles before restarting the service.
Restrict owner-level access to a minimal set of trusted administrators and rotate credentials for any shared owner accounts.

Patch Information

SurrealDB 2.1.0 addresses the vulnerability by validating role existence during user definition and by returning a structured error rather than panicking during role conversion. Details are published in the GitHub Security Advisory GHSA-jc55-246c-r88f.

Workarounds

Enforce strict change control on DEFINE USER statements and require peer review for any user creation performed by owner accounts.
Segment SurrealDB deployments so that a crash in one instance does not impact unrelated tenants or workloads.
Deploy process supervisors that automatically restart SurrealDB after a panic while alerting operators to investigate the cause.

bash

# Configuration example
# Verify installed SurrealDB version and upgrade if below 2.1.0
surreal version

# Query defined roles and users to identify orphaned role references
surreal sql --endpoint http://127.0.0.1:8000 \
  --user root --pass <password> \
  --ns <namespace> --db <database> \
  --pretty <<'EOF'
INFO FOR DB;
EOF