CVE-2026-63741 Overview
CVE-2026-63741 is an authorization bypass vulnerability in SurrealDB versions before 3.1.0. The database engine fails to validate DEFINE NAMESPACE and DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can create arbitrary namespaces and databases by issuing USE commands over the network. The flaw resides in the RPC use method and the SurrealQL executor, both of which skip authorization checks. The vulnerability is categorized as Missing Authorization [CWE-862] and affects deployments exposing the SurrealDB RPC or query interface to untrusted clients.
Critical Impact
Unauthenticated network attackers can create arbitrary namespaces and databases on affected SurrealDB instances, polluting the schema and enabling further abuse of storage resources.
Affected Products
- SurrealDB versions prior to 3.1.0
- Deployments exposing the SurrealDB RPC interface
- Deployments accepting SurrealQL statements from unauthenticated clients
Discovery Timeline
- 2026-07-20 - CVE-2026-63741 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-63741
Vulnerability Analysis
SurrealDB uses namespaces and databases as top-level containers for schema objects and data. Creating these containers requires the DEFINE NAMESPACE and DEFINE DATABASE privileges, which are normally reserved for root or namespace-level administrators. The USE NS <name> and USE DB <name> statements are intended to switch the active context for a session, not to create new containers. However, in versions before 3.1.0, the executor implicitly creates the target namespace or database when it does not exist, and skips the permission check that DEFINE statements enforce. Attackers can invoke this behavior through the RPC use method or by submitting a SurrealQL query, without providing valid credentials. The result is an authorization bypass classified under [CWE-862].
Root Cause
The RPC use handler and the SurrealQL executor do not consult the authorization layer before writing new namespace or database records to the underlying key-value store. The implicit creation path bypasses the guard that the explicit DEFINE NAMESPACE and DEFINE DATABASE statements enforce, leaving the write path reachable by an unauthenticated session.
Attack Vector
An attacker with network access to the SurrealDB endpoint opens an unauthenticated session and sends a USE NS attacker; USE DB attacker; sequence or the equivalent RPC use call. The server creates both containers and returns success. The attacker can repeat the call with arbitrary identifiers to spawn unbounded namespaces and databases. Integrity and availability of the schema are affected, though data confidentiality of existing tenants is not directly impacted.
No verified public exploit code is available. See the GitHub Security Advisory and the VulnCheck Advisory on SurrealDB for the vendor description of the flaw.
Detection Methods for CVE-2026-63741
Indicators of Compromise
- Unexpected namespaces or databases appearing in INFO FOR KV or INFO FOR NS output.
- RPC calls to the use method originating from unauthenticated sessions in SurrealDB logs.
- Sudden growth in the number of top-level containers stored in the SurrealDB backend.
Detection Strategies
- Enumerate namespaces and databases on a schedule and alert on entries not present in a maintained allowlist.
- Parse SurrealDB access logs for USE NS or USE DB statements issued by sessions that never completed a SIGNIN or SIGNUP.
- Monitor network traffic to SurrealDB ports for connections from sources outside expected application tiers.
Monitoring Recommendations
- Forward SurrealDB audit and access logs to a centralized analytics platform for retention and correlation.
- Track the count of namespaces and databases over time and alert on abnormal creation rates.
- Review authentication events alongside DDL activity to identify unauthenticated schema changes.
How to Mitigate CVE-2026-63741
Immediate Actions Required
- Upgrade SurrealDB to version 3.1.0 or later on all affected nodes.
- Restrict network exposure of the SurrealDB RPC and HTTP endpoints to trusted clients only.
- Audit existing namespaces and databases and remove any that were not provisioned by administrators.
Patch Information
SurrealDB 3.1.0 adds the missing authorization check on the USE NS and USE DB code paths, preventing implicit creation of namespaces and databases by unauthenticated sessions. Details are published in the GitHub Security Advisory GHSA-wp87-mgvq-5j93.
Workarounds
- Place SurrealDB behind a reverse proxy or firewall that enforces mutual TLS or IP allowlisting until the upgrade is applied.
- Disable anonymous access by configuring root credentials and requiring SIGNIN before any query execution.
- Isolate SurrealDB instances on private networks and block inbound access from the public internet.
# Verify installed SurrealDB version and upgrade
surreal version
# Example: start SurrealDB with root credentials to block anonymous sessions
surreal start --user root --pass "$SURREAL_ROOT_PASSWORD" \
--bind 127.0.0.1:8000 file:/var/lib/surrealdb/data
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
