CVE-2026-63742: SurrealDB Auth Bypass Vulnerability

CVE-2026-63742 Overview

CVE-2026-63742 is a field-level authorization bypass affecting SurrealDB versions before 3.1.0. The vulnerability resides in the indexed COUNT fast paths, where the query planner evaluates aggregate counts without enforcing field-level SELECT permissions. Authenticated attackers can issue COUNT queries against restricted fields to confirm or recover protected values through iterative guessing. The flaw is tracked as CWE-863: Incorrect Authorization and is documented in the SurrealDB GHSA-c8jx-96c9-8xrp advisory.

Critical Impact
Authenticated users can enumerate values in fields protected by row- or field-level SELECT permissions, breaking confidentiality assumptions for multi-tenant SurrealDB deployments.

Affected Products

SurrealDB versions prior to 3.1.0
Deployments relying on field-level SELECT permission clauses for confidentiality
Multi-tenant SurrealDB instances using indexed fields with per-record access control

Discovery Timeline

2026-07-20 - CVE-2026-63742 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63742

Vulnerability Analysis

SurrealDB supports fine-grained PERMISSIONS clauses that restrict SELECT access on individual fields. These clauses are expected to apply uniformly across all query paths that read the field. In vulnerable versions, the query planner uses an indexed fast path when executing COUNT aggregates over indexed fields. This fast path reads counts directly from index metadata and skips the per-record permission evaluation that normal record scans enforce.

As a result, an authenticated user without SELECT rights on a field can still learn how many records match a given predicate on that field. By issuing COUNT queries with progressively narrower WHERE clauses, an attacker binary-searches or brute-forces the restricted value. Sensitive attributes such as email addresses, phone numbers, tokens, or internal identifiers become recoverable one character at a time.

Root Cause

The root cause is inconsistent enforcement of field-level authorization between the record scan path and the indexed aggregate path. Permission checks were bound to record materialization rather than to logical field access, so any query that resolves without materializing records bypassed the check. This is a classic CWE-863 authorization gap in a query optimizer.

Attack Vector

Exploitation requires a valid authenticated session with query access to the target table but without SELECT permission on the restricted field. The attacker issues COUNT queries such as SELECT count() FROM users WHERE email = 'target@example.com' or predicate variations using string::starts_with against the indexed field. A non-zero count confirms the guessed value. Iterating over character positions reconstructs the full field content. See the VulnCheck advisory for additional exploitation context.

Detection Methods for CVE-2026-63742

Indicators of Compromise

High volumes of COUNT or count() queries from a single authenticated principal targeting the same table and indexed field
Repeated COUNT queries with incrementing string prefixes, character classes, or narrow equality predicates against restricted fields
Query patterns issued by principals whose PERMISSIONS FOR select clauses explicitly deny access to the referenced field
Anomalous query fan-out where the number of distinct WHERE clause literals for a single field exceeds normal application behavior

Detection Strategies

Enable SurrealDB query logging and forward COUNT-heavy sessions to a centralized analytics platform for rate and pattern review
Baseline the expected COUNT query frequency per role and alert on statistical deviations, especially against fields marked sensitive
Correlate authenticated session identifiers with the diversity of predicate values used in COUNT queries to surface enumeration attempts

Monitoring Recommendations

Instrument application-level access logs to record which authenticated identity issued each ad-hoc query and retain the query text
Monitor for spikes in aggregate queries following authentication events from newly issued tokens or newly onboarded tenants
Track error rates and permission-denied events alongside COUNT volume to identify probing behavior that precedes successful bypass

How to Mitigate CVE-2026-63742

Immediate Actions Required

Upgrade SurrealDB to version 3.1.0 or later on all production, staging, and development nodes
Inventory schemas that define field-level PERMISSIONS FOR select and treat any historical COUNT access to those tables as potentially exposed
Rotate credentials, tokens, or other secrets that were stored in fields protected only by field-level SELECT permissions
Restrict SurrealDB network exposure so that only trusted application tiers can authenticate and issue queries

Patch Information

SurrealDB addressed the issue in release 3.1.0. The fix propagates field-level SELECT permission evaluation into the indexed aggregate path so that COUNT queries respect the same authorization rules as record scans. Full remediation details are available in the SurrealDB GHSA-c8jx-96c9-8xrp advisory.

Workarounds

Revoke query privileges on affected tables for roles that must not learn field values until the upgrade is complete
Move highly sensitive fields into separate tables governed by table-level SELECT permissions rather than field-level clauses
Introduce an application-layer proxy that rejects COUNT and aggregate queries from untrusted principals against sensitive tables
Rate-limit authenticated query volume per principal to slow enumeration attempts while patching is scheduled

bash

# Example: upgrade SurrealDB container image to the patched release
docker pull surrealdb/surrealdb:v3.1.0
docker stop surrealdb && docker rm surrealdb
docker run -d --name surrealdb -p 8000:8000 \
  surrealdb/surrealdb:v3.1.0 start --auth --user root --pass "$SURREAL_ROOT_PASS"

# Verify the running version
curl -s http://localhost:8000/version