CVE-2026-63754: SurrealDB Denial of Service Vulnerability

CVE-2026-63754 Overview

CVE-2026-63754 is a denial of service vulnerability in SurrealDB versions before 3.1.0. The flaw allows an authenticated user with only select permission to block all CREATE, UPDATE, and DELETE operations on a target table. The attacker registers a LIVE query with a WHERE clause that evaluates to an error. Every subsequent write operation on the watched table fails until the query is killed or the session ends. The impact extends to root-level users, making privilege boundaries irrelevant to the attack. The vulnerability is tracked under CWE-754: Improper Check for Unusual or Exceptional Conditions.

Critical Impact
A low-privileged authenticated user can halt all write operations on any table, including operations performed by the root account, until the malicious LIVE query terminates.

Affected Products

SurrealDB versions prior to 3.1.0
Deployments exposing authenticated user accounts with select permission
Multi-tenant SurrealDB instances relying on role-based write isolation

Discovery Timeline

2026-07-20 - CVE-2026-63754 published to the National Vulnerability Database (NVD)
2026-07-22 - Last updated in NVD database
2026-07-23 - EPSS score recorded at 0.254% (percentile 16.983)

Technical Details for CVE-2026-63754

Vulnerability Analysis

SurrealDB supports LIVE queries, a feature that streams real-time changes on a table to subscribed clients. Each LIVE query registers a WHERE clause that the database evaluates against every mutation on the watched table. When the WHERE clause raises an evaluation error, SurrealDB does not isolate the failure to the subscriber. Instead, the error propagates to the mutation itself, causing CREATE, UPDATE, and DELETE operations to abort. Any authenticated user holding select permission on a table can register such a query. Once registered, the malicious LIVE query persists until the session closes or an administrator issues a KILL command against it. Root users receive no privileged bypass, since the evaluation error occurs before any authorization decision on the mutation.

Root Cause

The root cause aligns with CWE-754: improper handling of exceptional conditions raised inside LIVE query WHERE clause evaluation. The write pipeline treats evaluation errors from subscribers as fatal to the underlying mutation rather than isolating them to the subscription channel.

Attack Vector

The attack requires network access to the SurrealDB endpoint and low-privilege authenticated credentials with select permission on the target table. The attacker submits a LIVE SELECT statement containing a WHERE clause guaranteed to error at evaluation time — for example, arithmetic on incompatible types, invalid function invocations, or references to undefined variables. From that point forward, every write to the watched table fails. See the SurrealDB GitHub Security Advisory GHSA-4v76-cw68-4vc9 and the VulnCheck advisory for additional technical context.

Detection Methods for CVE-2026-63754

Indicators of Compromise

Repeated write failures (CREATE, UPDATE, DELETE) on a specific table while reads continue to succeed
Presence of active LIVE queries registered by non-administrative users on business-critical tables
Server logs showing recurring WHERE clause evaluation errors originating from LIVE query IDs
Sudden write throughput drop to zero on a table without corresponding infrastructure events

Detection Strategies

Enumerate active LIVE queries using SurrealDB administrative interfaces and cross-reference the owning user against expected subscribers
Alert when a single session registers LIVE queries whose WHERE clauses reference undefined fields, mismatched types, or invalid function calls
Correlate application-side write errors with database evaluation errors emitted for the same table within the same time window

Monitoring Recommendations

Track the count of active LIVE queries per user and per table, and flag deviations from baseline
Forward SurrealDB error logs to a centralized data lake and pivot on repeated evaluation-error signatures tied to LIVE query identifiers
Monitor write-error-rate metrics per table so denial of service conditions surface within seconds rather than during user complaints

How to Mitigate CVE-2026-63754

Immediate Actions Required

Upgrade all SurrealDB deployments to version 3.1.0 or later
Audit existing LIVE queries and KILL any registered by unexpected accounts
Review permissions and revoke select access from accounts that do not require it on sensitive tables
Rotate credentials for accounts suspected of registering malicious LIVE queries

Patch Information

SurrealDB resolved CVE-2026-63754 in version 3.1.0. The fix ensures that evaluation errors inside a LIVE query WHERE clause do not propagate to the write path of the watched table. Refer to the SurrealDB GitHub Security Advisory GHSA-4v76-cw68-4vc9 for the authoritative patch reference.

Workarounds

Restrict LIVE query usage to trusted service accounts through role and permission scoping
Terminate suspicious sessions and KILL offending LIVE query IDs when write failures are observed
Place SurrealDB behind an application-layer proxy that inspects and rate-limits LIVE SELECT statements from low-privilege users

bash

# List and terminate a suspicious LIVE query in SurrealDB
# 1. Identify the LIVE query ID from the session or server logs
# 2. Kill it to restore write operations on the watched table
KILL "<live_query_id>";