CVE-2026-63748: SurrealDB Information Disclosure Flaw

CVE-2026-63748 Overview

CVE-2026-63748 is an information disclosure vulnerability in SurrealDB versions before 3.1.0. Authenticated users with UPDATE access can read field values that should be hidden by field-level SELECT permissions. The flaw arises because arithmetic and extend operations against protected fields embed raw operand values in error messages returned to the client. This bypasses field-level access controls that database administrators configure to segregate sensitive data.

The issue is tracked under CWE-209: Generation of Error Message Containing Sensitive Information and is documented in the SurrealDB GitHub Security Advisory.

Critical Impact
Authenticated attackers with UPDATE privileges can extract protected field values from any record, defeating field-level SELECT permission boundaries in multi-tenant SurrealDB deployments.

Affected Products

SurrealDB versions prior to 3.1.0
Deployments relying on field-level SELECT permissions for data segregation
Multi-tenant SurrealDB instances with role-based field access controls

Discovery Timeline

2026-07-20 - CVE-2026-63748 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63748

Vulnerability Analysis

SurrealDB supports field-level permissions that restrict which authenticated users can read specific record fields via SELECT clauses. The permission model is designed to allow write access without disclosing the current value of a protected field. CVE-2026-63748 breaks this contract by leaking hidden field values through error messages generated during expression evaluation.

When an authenticated user with UPDATE access issues an arithmetic operation, such as adding a numeric value to a string-typed hidden field, the query engine attempts to coerce the operands. The resulting type-mismatch error message includes the raw operand value pulled from the hidden field. The attacker sees this value in the client response even though a direct SELECT against that field would be denied.

The same class of leak applies to the extend operator and other operations that inline operand contents into error strings. See the VulnCheck Information Disclosure Advisory for additional detail.

Root Cause

The root cause is improper handling of sensitive data in diagnostic output [CWE-209]. Error formatters in the query engine embed unfiltered field values without consulting the field-level permission evaluator. The permission check gates the SELECT projection path but not the error-generation path.

Attack Vector

An attacker authenticated with low-privilege UPDATE access issues crafted update statements that trigger arithmetic or extend operations on the target hidden field. The database returns an error containing the raw operand value. The attacker iterates across records or fields to enumerate protected data over the network. Exploitation requires only valid credentials and network access to the SurrealDB endpoint; no user interaction is needed.

No verified public proof-of-concept code has been released. The vulnerability mechanism is described in the vendor advisory linked above.

Detection Methods for CVE-2026-63748

Indicators of Compromise

Spikes in failed query errors referencing type coercion, arithmetic mismatch, or extend operator failures against sensitive tables.
Repeated UPDATE statements from a single session targeting fields the user should not be able to read.
Query logs showing systematic iteration across record IDs paired with predictable error responses.

Detection Strategies

Enable SurrealDB query and error logging, then baseline normal error rates per authenticated user and per table.
Alert on authenticated sessions that generate high volumes of expression-evaluation errors within short time windows.
Correlate UPDATE traffic with error responses referencing hidden fields defined in the schema.

Monitoring Recommendations

Forward SurrealDB logs to a centralized SIEM or data lake and retain them for retrospective hunting.
Track per-principal error-to-success ratios and flag deviations against a rolling baseline.
Monitor network traffic to database endpoints for unusual query patterns originating from application service accounts.

How to Mitigate CVE-2026-63748

Immediate Actions Required

Upgrade SurrealDB to version 3.1.0 or later on all instances.
Audit existing field-level SELECT permissions and identify which fields were relied upon for confidentiality.
Rotate any secrets, tokens, or credentials that may have been stored in protected fields and could have been exposed.
Review access logs for anomalous UPDATE activity from low-privilege accounts.

Patch Information

SurrealDB has released version 3.1.0, which corrects the error-message formatting to respect field-level SELECT permissions. Refer to the SurrealDB GitHub Security Advisory GHSA-6g9v-7gq3-p2c6 for official patch guidance and version details.

Workarounds

Restrict UPDATE privileges to trusted principals until the upgrade is applied.
Move highly sensitive fields into separate tables protected by table-level rather than field-level permissions.
Place SurrealDB behind a query proxy that filters or normalizes error responses returned to untrusted clients.
Suppress verbose error messages at the application layer so raw operand values are never surfaced to end users.

bash

# Verify installed SurrealDB version and upgrade to 3.1.0 or later
surreal version

# Example upgrade path using the official installer
curl -sSf https://install.surrealdb.com | sh -s -- --version 3.1.0

# Confirm the upgrade succeeded
surreal version