CVE-2026-63749 Overview
CVE-2026-63749 is an authentication bypass vulnerability in SurrealDB versions before 3.1.0. The flaw resides in the LIVE SELECT subscription mechanism, where permission expressions referencing $value, $before, $after, or $event evaluate against attacker-controlled bindings instead of actual documents. Authenticated subscribers can bind arbitrary values to these parameter names and register LIVE SELECT queries to receive notifications for records that SELECT permission expressions should have hidden. The issue is classified under CWE-863: Incorrect Authorization.
Critical Impact
Authenticated users can subscribe to change notifications on records outside their authorization scope, resulting in unauthorized disclosure of protected data through real-time subscriptions.
Affected Products
- SurrealDB versions prior to 3.1.0
- Deployments relying on SELECT permission expressions that reference $value, $before, $after, or $event
- Any SurrealDB instance exposing LIVE SELECT subscriptions to authenticated tenants
Discovery Timeline
- 2026-07-20 - CVE-2026-63749 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-63749
Vulnerability Analysis
SurrealDB supports LIVE SELECT queries, which allow authenticated clients to subscribe to changes on tables and receive notifications when records are created, updated, or deleted. Access to these notifications is gated by SELECT permission expressions defined on the target table. These expressions typically reference document-scoped parameters such as $value, $before, $after, and $event to make authorization decisions based on the actual document content.
The vulnerability stems from how the LIVE SELECT evaluator resolves these parameters. Instead of binding them exclusively from the underlying document during change evaluation, the engine honors bindings supplied by the subscriber when the LIVE SELECT query is registered. An authenticated client can therefore inject synthetic values for $value, $before, $after, or $event that satisfy the SELECT permission expression, regardless of the true contents of the record being changed.
As a result, the permission check becomes a comparison against attacker-supplied data rather than the record itself. Notifications flow to subscribers for records they should not be able to read.
Root Cause
The root cause is improper scoping of query parameter bindings during authorization evaluation. Reserved document-context variables are not protected from client-supplied overrides in the LIVE SELECT registration path, causing the permission engine to trust untrusted input for the values it uses to decide access.
Attack Vector
Exploitation requires an authenticated account with permission to register LIVE SELECT subscriptions on the target namespace or database. The attacker crafts a LIVE SELECT query that binds chosen values to $value, $before, $after, or $event and issues it over the SurrealDB network protocol. When any record change occurs on the subscribed table, the permission expression is evaluated against the attacker's bindings and returns true, delivering the change notification. Attack complexity is low, no user interaction is required, and the attack occurs over the network.
No public proof-of-concept code is currently available. See the VulnCheck Advisory and the GitHub Security Advisory for technical details.
Detection Methods for CVE-2026-63749
Indicators of Compromise
- LIVE SELECT queries registered by authenticated users that include explicit LET or parameter bindings for $value, $before, $after, or $event.
- Unusual volume of live notifications delivered to a single session across tables the account rarely queries.
- Subscriptions from application service accounts that historically only issue standard SELECT statements.
Detection Strategies
- Enable SurrealDB query logging and inspect LIVE SELECT statements for client-supplied bindings that shadow reserved document parameters.
- Correlate LIVE SELECT registrations with the identity of the subscriber and the SELECT permission expressions defined on the target table.
- Alert when a subscription receives notifications for records the same identity cannot retrieve via an equivalent non-live SELECT statement.
Monitoring Recommendations
- Forward SurrealDB access and query logs to a centralized SIEM or data lake for retention and correlation.
- Track baseline LIVE SELECT usage per role and flag deviations in query shape, table scope, or parameter usage.
- Monitor authentication events for accounts that suddenly begin registering LIVE SELECT subscriptions after previously using only read APIs.
How to Mitigate CVE-2026-63749
Immediate Actions Required
- Upgrade SurrealDB to version 3.1.0 or later on all namespaces, databases, and clustered nodes.
- Audit existing SELECT permission expressions that reference $value, $before, $after, or $event and validate their behavior against the patched version.
- Rotate credentials for any accounts that could have registered abusive LIVE SELECT subscriptions during the exposure window.
Patch Information
SurrealDB has addressed the vulnerability in release 3.1.0. Refer to the SurrealDB GitHub Security Advisory for the official fix and upgrade guidance.
Workarounds
- Disable LIVE SELECT functionality for untrusted or multi-tenant roles until the patch is deployed.
- Restrict database and table-level permissions so that only trusted service identities can register live subscriptions.
- Rewrite SELECT permission expressions to avoid sole reliance on $value, $before, $after, or $event, and instead combine them with session-scoped identity checks such as $auth or $session.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
