CVE-2026-63739 Overview
CVE-2026-63739 is an arbitrary file read vulnerability in SurrealDB versions before 3.1.5. The flaw resides in the DEFINE ANALYZER mapper filter, which accepts user-controlled file paths without enforcing the SURREAL_FILE_ALLOWLIST. Authenticated users holding EDITOR or OWNER roles can specify arbitrary file paths and exfiltrate file contents through query error messages returned by the database engine. The issue is tracked as a path traversal weakness [CWE-22] and affects deployments where the file allowlist is empty or not configured.
Critical Impact
Authenticated database users can read any file on the host that is accessible to the SurrealDB process, including configuration files, credentials, and secrets.
Affected Products
- SurrealDB versions prior to 3.1.5
- Deployments where SURREAL_FILE_ALLOWLIST is empty or unset
- Any SurrealDB instance exposing EDITOR or OWNER role access
Discovery Timeline
- 2026-07-20 - CVE-2026-63739 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-63739
Vulnerability Analysis
SurrealDB provides a DEFINE ANALYZER statement that lets database administrators configure text analyzers with pluggable filters, including a mapper filter that reads token mappings from a file on disk. The mapper filter accepts a file path argument and loads content during analyzer definition. When the file cannot be parsed as a valid mapping, SurrealDB surfaces the file contents inside the query error response returned to the caller.
Because the mapper filter does not enforce the SURREAL_FILE_ALLOWLIST when the allowlist is empty or unset, an authenticated user with the EDITOR or OWNER role can point the filter at any path readable by the database process. Sensitive files such as /etc/passwd, application configuration, TLS keys, or cloud credential files can be extracted directly through error output.
Root Cause
The root cause is missing path validation in the mapper filter combined with error messages that echo file contents. The default configuration ships without a populated SURREAL_FILE_ALLOWLIST, so filesystem access controls fall back to the operating system permissions of the SurrealDB process rather than an application-level allowlist.
Attack Vector
The attack requires network access to the SurrealDB endpoint and valid credentials mapped to either the EDITOR or OWNER role. The attacker issues a DEFINE ANALYZER statement referencing a mapper filter with a target file path, then triggers a parse failure to retrieve the file contents from the returned error message. No user interaction or elevated system privileges are required beyond the authenticated database role.
Refer to the GitHub Security Advisory GHSA-cc8f-fcx3-gpjr and the VulnCheck Advisory for reproduction details.
Detection Methods for CVE-2026-63739
Indicators of Compromise
- DEFINE ANALYZER statements in query logs that include a mapper filter referencing absolute filesystem paths such as /etc/, /root/, or application secret directories.
- Query error responses containing raw file contents rather than analyzer parsing errors.
- Repeated analyzer definitions from a single session probing multiple filesystem locations.
Detection Strategies
- Enable verbose query auditing on SurrealDB and alert on any use of DEFINE ANALYZER ... FILTERS MAPPER with file path arguments.
- Baseline expected analyzer definitions and flag deviations, particularly those authored by accounts that do not normally manage schemas.
- Correlate EDITOR and OWNER role activity with unexpected access patterns or off-hours administrative statements.
Monitoring Recommendations
- Ship SurrealDB query and error logs to a centralized analytics platform and retain them for post-incident review.
- Monitor process-level file read syscalls on the SurrealDB host for reads outside the database data directory.
- Track authentication events for EDITOR and OWNER accounts and alert on new or unusual source IP addresses.
How to Mitigate CVE-2026-63739
Immediate Actions Required
- Upgrade SurrealDB to version 3.1.5 or later on all affected nodes.
- Configure SURREAL_FILE_ALLOWLIST explicitly with the minimum set of directories required by legitimate analyzers.
- Audit existing analyzer definitions for suspicious mapper filter paths and remove any that were not authorized.
- Rotate credentials, keys, and secrets that were stored on disk on affected hosts and could have been exposed.
Patch Information
The vendor fixed the issue in SurrealDB 3.1.5. Upgrade instructions and the full security advisory are available in the SurrealDB GitHub Security Advisory.
Workarounds
- Set SURREAL_FILE_ALLOWLIST to a restricted directory dedicated to analyzer resources and mount it read-only where possible.
- Restrict EDITOR and OWNER role assignments to a minimal set of trusted administrators and disable these roles for application service accounts.
- Run the SurrealDB process under a dedicated low-privilege user account with no read access to system or application secrets.
- Place SurrealDB behind network controls that limit administrative endpoints to trusted management networks.
# Configuration example: restrict file access via allowlist
export SURREAL_FILE_ALLOWLIST="/var/lib/surrealdb/analyzers"
surreal start --user root --pass "$SURREAL_ROOT_PASS" file://data
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
