CVE-2026-63746: SurrealDB Auth Bypass Vulnerability

CVE-2026-63746 Overview

CVE-2026-63746 is a broken access control vulnerability in SurrealDB versions before 3.1.0. The database engine fails to enforce table-level SELECT permissions when queries traverse graph edges or back-references. Authenticated users can read records from any table reachable through a graph relationship, regardless of the target table's PERMISSIONS FOR select clause.

The flaw allows tenants and low-privilege accounts to bypass row and table security by pivoting through graph queries. Sensitive data stored in tables the caller cannot directly query becomes accessible whenever a graph edge points to it. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Authenticated users can read arbitrary records from any table reachable via graph edges, bypassing SurrealDB's declarative PERMISSIONS FOR select access controls.

Affected Products

SurrealDB versions prior to 3.1.0
Deployments using record-level authentication with PERMISSIONS FOR select clauses
Multi-tenant SurrealDB instances relying on table permissions for data isolation

Discovery Timeline

2026-07-20 - CVE-2026-63746 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63746

Vulnerability Analysis

SurrealDB is a multi-model database that supports graph relationships through directed edges. Developers protect tables using the DEFINE TABLE ... PERMISSIONS FOR select WHERE ... clause. This clause is expected to gate any read against the table, whether the read originates from a direct SELECT statement or from a graph traversal expression such as ->edge->target or a back-reference <-edge<-source.

The query planner enforces permissions on the entry table but omits the permission check when materializing records reached through graph edges. An authenticated user with access to a low-sensitivity table can therefore follow an edge to a high-sensitivity table and read every field the edge exposes. The classification maps to [CWE-200] information exposure.

Exploitation requires only valid authenticated credentials with SELECT rights on any table that contains an outgoing or incoming edge to a restricted table. No elevated role, network position, or user interaction is needed.

Root Cause

The permission-enforcement layer is bound to the top-level statement rather than to each record fetch performed during query execution. When the executor resolves graph traversal operators, it retrieves the linked records directly through the storage engine and skips the predicate defined in PERMISSIONS FOR select on the destination table. Back-references exhibit the same behavior because they share the traversal code path.

Attack Vector

An authenticated attacker issues a SurrealQL query that starts from a table they may read and follows a graph edge into a restricted table. Because the executor does not re-check the destination table's permissions, the query returns fields that the record-level policy should have hidden. For technical details, see the GitHub Security Advisory GHSA-vjjx-rfw4-rmfc and the VulnCheck Advisory on SurrealDB.

Detection Methods for CVE-2026-63746

Indicators of Compromise

Authenticated sessions issuing SurrealQL queries that use graph traversal operators (->, <-) or back-reference syntax against tables the account cannot directly SELECT.
Unexpected result sets returning fields from tables that carry a restrictive PERMISSIONS FOR select clause.
Application accounts producing query volumes or response sizes inconsistent with their normal access patterns.

Detection Strategies

Enable SurrealDB query logging and search for statements combining edge traversal operators with tables marked sensitive in the schema.
Correlate authenticated user identity against the set of tables actually returned in query results to surface access outside declared privileges.
Audit application code paths that construct dynamic SurrealQL to confirm none intentionally rely on the bypassed traversal behavior.

Monitoring Recommendations

Ship SurrealDB access and query logs to a centralized analytics platform and alert on graph traversal targeting restricted tables.
Track SurrealDB version banners across environments to identify hosts still running releases below 3.1.0.
Baseline per-account query patterns and alert on deviations in traversal depth or destination tables.

How to Mitigate CVE-2026-63746

Immediate Actions Required

Upgrade all SurrealDB instances to version 3.1.0 or later, which enforces PERMISSIONS FOR select on graph-traversed records.
Inventory schemas for tables that hold sensitive data and confirm none are reachable through unnecessary edges from lower-trust tables.
Rotate credentials for any authenticated accounts whose queries cannot be verified as compliant during the exposure window.

Patch Information

SurrealDB addressed CVE-2026-63746 in release 3.1.0. The fix extends the permission enforcement layer to evaluate the destination table's PERMISSIONS FOR select clause during graph edge and back-reference resolution. Refer to the GitHub Security Advisory GHSA-vjjx-rfw4-rmfc for release notes and upgrade instructions.

Workarounds

Restrict authenticated roles so they cannot execute graph traversal queries against schemas that contain restricted tables until the upgrade is complete.
Remove or restructure graph edges that link low-sensitivity tables to restricted tables where the linkage is not required by the application.
Enforce query allow-listing at the application tier so that only vetted SurrealQL statements reach the database.

bash

# Verify SurrealDB server version and upgrade if below 3.1.0
surreal version
# Example upgrade (Linux binary install)
curl -sSf https://install.surrealdb.com | sh -s -- --version 3.1.0