CVE-2024-58362: SurrealDB Auth Bypass Vulnerability

CVE-2024-58362 Overview

CVE-2024-58362 is a query injection vulnerability in SurrealDB affecting versions before 1.5.5 and 2.0.0-beta before 2.0.0-beta.3. The database accepts arbitrary objects in the signin and signup operations of the RPC API without recursively validating them for non-computed values. An unauthenticated attacker can submit a bincode-serialized binary object containing a subquery in place of credentials. That subquery executes inside the record access SIGNIN or SIGNUP query under a system user session with the editor role. The flaw is categorized under CWE-75: Failure to Sanitize Special Elements into a Different Plane.

Critical Impact
Unauthenticated attackers can execute injected subqueries with editor-role privileges, allowing them to select, create, update, and delete non-IAM resources in the database.

Affected Products

SurrealDB versions prior to 1.5.5
SurrealDB 2.0.0-beta versions prior to 2.0.0-beta.3
Deployments exposing the RPC API to untrusted users with record access methods defining SIGNIN or SIGNUP queries

Discovery Timeline

2026-07-18 - CVE-2024-58362 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2024-58362

Vulnerability Analysis

SurrealDB exposes an RPC API that accepts signin and signup calls carrying a credential object. The server deserializes this object using the bincode format but does not recursively validate its contents to ensure only literal, non-computed values are present. An attacker can embed a subquery expression inside the deserialized structure. When the record access method's SIGNIN or SIGNUP query references the attacker-supplied field, the embedded subquery is evaluated as part of query execution.

Because the SIGNIN and SIGNUP queries defined by a record access method run under a system user session with the editor role, the injected subquery inherits those privileges. The attacker cannot view subquery results directly and cannot modify IAM resources, which require the owner role. However, the editor role permits reading, creating, updating, and deleting all non-IAM data in the database.

Root Cause

The root cause is missing recursive validation of the deserialized credential object. SurrealDB trusts the structure produced by bincode deserialization instead of enforcing that credential fields contain only literal values. This allows an embedded query expression to survive into the query evaluator.

Attack Vector

Exploitation requires network access to the SurrealDB RPC endpoint and a target namespace or database that defines a record access method with a SIGNIN or SIGNUP query. The attacker crafts a bincode-serialized payload where a credential value is replaced with a subquery object, then sends it as the parameters to the signin or signup RPC method. No prior authentication is required. Full technical details are available in the GitHub Security Advisory GHSA-64f8-pjgr-9wmr and the VulnCheck Advisory on SurrealDB.

Detection Methods for CVE-2024-58362

Indicators of Compromise

Unexpected bincode-formatted payloads submitted to the signin or signup RPC methods on the SurrealDB endpoint.
Unexplained create, update, or delete operations on non-IAM records performed by system-user editor sessions.
Failed or anomalous authentication attempts against record access methods that define SIGNIN or SIGNUP queries.

Detection Strategies

Enable SurrealDB query logging and alert on write operations executed within SIGNIN or SIGNUP query contexts, since these should normally only perform read validation.
Inspect RPC request payloads for deeply nested credential structures or non-primitive values where scalar strings are expected.
Correlate authentication requests from untrusted client IPs with subsequent data modifications on non-IAM tables.

Monitoring Recommendations

Forward SurrealDB access, query, and RPC logs to a centralized log platform and retain them long enough to support retrospective investigation.
Baseline normal signin and signup payload sizes and shapes, then alert on deviations that suggest embedded subqueries.
Track schema and record changes on non-IAM resources and review any modifications not tied to a legitimate authenticated user session.

How to Mitigate CVE-2024-58362

Immediate Actions Required

Upgrade SurrealDB to version 1.5.5 or later, or to 2.0.0-beta.3 or later for beta deployments.
Restrict network exposure of the RPC API so it is not reachable by untrusted users while patching is in progress.
Audit all record access methods that define SIGNIN or SIGNUP queries and review recent database activity for signs of unauthorized modification.

Patch Information

SurrealDB addressed the issue in versions 1.5.5 and 2.0.0-beta.3 by recursively validating credential objects supplied to signin and signup RPC operations. See the GitHub Security Advisory GHSA-64f8-pjgr-9wmr for the fix reference and release notes.

Workarounds

Remove or disable record access methods that define SIGNIN or SIGNUP queries until the upgrade is applied.
Place the SurrealDB RPC endpoint behind an authenticated reverse proxy or network allowlist to prevent anonymous access.
Enforce strict schema validation upstream so that only string credential values reach the RPC API.

bash

# Example: restrict SurrealDB RPC exposure with a firewall rule
# Replace <trusted_cidr> with the CIDR of your application tier
iptables -A INPUT -p tcp --dport 8000 -s <trusted_cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP