CVE-2024-58363 Overview
CVE-2024-58363 is an authentication bypass vulnerability in SurrealDB versions before 1.5.4. The flaw resides in how the database engine handles scope users when they switch databases using the USE clause or the use method. SurrealDB fails to re-validate authentication after the database context changes. An attacker holding a valid authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists in that target database. Applications enforcing permissions solely through the $auth parameter grant unauthorized access to actions and data belonging to the impersonated identity.
Critical Impact
Authenticated scope users can cross database boundaries and impersonate identically-named identities, executing actions permitted by the target database's authorization logic.
Affected Products
- SurrealDB versions prior to 1.5.4
- Applications relying on the $auth parameter for permission checks
- Multi-tenant deployments sharing scope user identifiers across databases
Discovery Timeline
- 2026-07-18 - CVE-2024-58363 published to the National Vulnerability Database (NVD)
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2024-58363
Vulnerability Analysis
SurrealDB implements scope users as records inside a specific database. When an authenticated session issues a USE clause to switch database context, the engine changes the active namespace and database but does not re-authenticate the session against the new target. The $auth parameter continues to reference the original user record identifier. If a record with the same identifier exists in the destination database, the engine treats the session as if it were authenticated against that record.
This behavior maps to Improper Authentication [CWE-287]. Any application layer that evaluates access using expressions such as WHERE user = $auth.id or permission rules referencing $auth will authorize the attacker as the impersonated user. The vulnerability is exploitable over the network by any user with valid credentials on any database in the deployment.
Root Cause
The engine performs authentication once at session establishment and preserves the resulting identity across database transitions. There is no rebinding of the authenticated principal to the new database's user table when the USE clause is executed. The trust boundary between databases is not enforced at the authentication layer.
Attack Vector
An attacker registers or obtains valid scope credentials in database A. The attacker then issues a USE statement to switch to database B, where a differently-owned user record shares the attacker's identifier. Subsequent queries in database B execute with $auth values that map to the victim record, bypassing per-tenant isolation. Details are documented in the GitHub Security Advisory and the VulnCheck Advisory.
Detection Methods for CVE-2024-58363
Indicators of Compromise
- SurrealDB query logs showing USE clauses or use method calls immediately followed by privileged data access
- Sessions authenticated against one scope executing writes referencing records owned by users in a different database
- Authentication events where $auth identifiers appear across multiple database contexts within a single session
Detection Strategies
- Instrument SurrealDB with query auditing to record the namespace and database context for every statement executed by a session
- Alert on sequences where a scope authentication is followed by a USE clause targeting a database the user was not originally provisioned in
- Correlate application-layer identity claims with the database context at query execution time to detect mismatches
Monitoring Recommendations
- Forward SurrealDB access logs to a centralized SIEM and build detections keyed on cross-database session activity
- Track the version string reported by SurrealDB instances to identify unpatched deployments running below 1.5.4
- Review permission definitions that reference $auth and log evaluations of those rules for anomaly analysis
How to Mitigate CVE-2024-58363
Immediate Actions Required
- Upgrade all SurrealDB instances to version 1.5.4 or later
- Audit permission expressions that rely on $auth and add explicit database or namespace checks
- Rotate scope user credentials in any deployment where identical identifiers may exist across databases
Patch Information
SurrealDB resolved the issue in release 1.5.4. The fix ensures that switching databases via USE invalidates or re-validates the authenticated principal so $auth cannot reference a user record from a foreign database. Refer to the GitHub Security Advisory GHSA-gh9f-6xm2-c4j2 for release notes and commit references.
Workarounds
- Restrict use of the USE clause at the application gateway until the upgrade is applied
- Enforce namespace and database identifiers as additional predicates in every permission rule rather than trusting $auth alone
- Segregate tenants into separate SurrealDB instances where cross-database USE is not required by the application
# Verify installed SurrealDB version and upgrade to the patched release
surreal version
# Upgrade example using the official installer
curl -sSf https://install.surrealdb.com | sh -s -- --version v1.5.4
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
