CVE-2026-63735 Overview
CVE-2026-63735 is an authorization bypass vulnerability in SurrealDB versions before 3.2.0. The database engine fails to validate namespace and database scope in custom API routes. Authenticated users can invoke endpoints in namespaces or databases they do not own by specifying the target scope in the URL path. Attackers holding valid credentials for any tenant can read sensitive data or trigger unintended operations in other tenants. The flaw is tracked under [CWE-639: Authorization Bypass Through User-Controlled Key] and affects multi-tenant SurrealDB deployments that rely on custom API endpoints for application logic.
Critical Impact
Any authenticated SurrealDB user can cross tenant boundaries to invoke custom API endpoints in other namespaces or databases, leading to confidentiality and integrity loss across tenants.
Affected Products
- SurrealDB versions prior to 3.2.0
- Multi-tenant SurrealDB deployments exposing custom API routes
- Applications relying on SurrealDB namespace and database isolation for access control
Discovery Timeline
- 2026-07-20 - CVE-2026-63735 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-63735
Vulnerability Analysis
SurrealDB supports custom API routes that let developers extend the database with HTTP endpoints scoped to a specific namespace and database. The routing layer accepts the namespace and database identifiers directly from the request URL path. Before version 3.2.0, the server executes the matching route without verifying that the caller's authentication token grants access to the target namespace and database.
Any authenticated principal can therefore substitute the path components with the identifiers of another tenant. The engine resolves the custom endpoint in the specified tenant and executes the associated logic under the attacker's session. This breaks the multi-tenant isolation model that SurrealDB users rely on when granting scoped credentials to different applications or customers.
The vulnerability is classified as an Authorization Bypass Through User-Controlled Key. The attack requires low privileges, no user interaction, and a network-reachable SurrealDB instance.
Root Cause
The custom API route handler resolves the requested endpoint using the namespace and database from the URL, but omits a check that compares those values against the scope granted to the presented credentials. Authentication is validated, yet authorization is not enforced at the tenant boundary. This is a classic broken access control pattern where the routing key is trusted as a scoping mechanism.
Attack Vector
An attacker first obtains valid credentials in any namespace and database on the target instance. Signup, invitations, or a compromised low-value tenant can supply such credentials. The attacker then issues an HTTP request to a custom API route, replacing the namespace and database segments in the path with those of a victim tenant. SurrealDB dispatches the request to the victim tenant's endpoint, returning data or performing operations that should be restricted. Exploitation requires knowledge of the target namespace and database identifiers, which are often discoverable through enumeration or documentation.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-848m-r628-vrxw and the VulnCheck Security Advisory for technical details.
Detection Methods for CVE-2026-63735
Indicators of Compromise
- HTTP requests to custom API routes where the URL namespace or database segment does not match the tenant tied to the authenticating token or session.
- Access log entries showing a single authenticated principal invoking custom API endpoints across multiple distinct namespaces or databases within a short window.
- Unexpected reads or writes recorded in custom API handlers that were previously scoped to a single tenant.
Detection Strategies
- Correlate the authenticated user's assigned namespace and database with the namespace and database extracted from each custom API request path. Alert on any mismatch.
- Baseline custom API traffic per tenant and flag deviations where one identity touches endpoints belonging to tenants it has never accessed before.
- Review SurrealDB audit and access logs for enumeration patterns against /api/ or equivalent custom route prefixes across multiple tenant identifiers.
Monitoring Recommendations
- Forward SurrealDB HTTP access logs and application logs to a centralized analytics platform for cross-tenant correlation.
- Instrument custom API handlers to record the authenticated principal, the requested namespace, and the requested database on every invocation.
- Alert on error responses that indicate scope mismatches once a patched version enforces isolation, as these may indicate active probing.
How to Mitigate CVE-2026-63735
Immediate Actions Required
- Upgrade SurrealDB to version 3.2.0 or later on all nodes as soon as possible.
- Inventory every custom API route and identify those handling sensitive data or state-changing operations.
- Rotate credentials for any tenant that could have been used as a foothold, particularly self-service or trial accounts.
Patch Information
SurrealDB has released version 3.2.0, which validates that the namespace and database in the request path match the scope authorized by the caller's credentials. Deployment details and fixed commits are documented in the GitHub Security Advisory GHSA-848m-r628-vrxw.
Workarounds
- Place SurrealDB behind a reverse proxy that enforces tenant isolation by validating the requested namespace and database against the authenticated identity before forwarding the request.
- Disable custom API routes on multi-tenant deployments until the upgrade to 3.2.0 is complete.
- Restrict network exposure of SurrealDB HTTP endpoints to trusted application tiers and remove direct internet reachability where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
