CVE-2026-63755: SurrealDB Auth Bypass Vulnerability

CVE-2026-63755 Overview

CVE-2026-63755 is a broken access control vulnerability [CWE-863] in SurrealDB versions prior to 3.1.0. The database evaluates user-supplied WHERE clauses in SELECT statements against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. This ordering flaw also affects SET, MERGE, CONTENT, and PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE statements. Authenticated users, including Record and Scope users, can read the full contents of any table within their current database. The vulnerability does not cross namespace or database isolation boundaries.

Critical Impact
Authenticated attackers can exfiltrate full table contents across the current database, bypassing table-level PERMISSIONS checks through query evaluation ordering flaws.

Affected Products

SurrealDB versions prior to 3.1.0
Deployments with Record or Scope user authentication enabled
Instances with --allow-scripting enabled (highest exposure)

Discovery Timeline

2026-07-20 - CVE-2026-63755 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63755

Vulnerability Analysis

SurrealDB enforces row-level access control through PERMISSIONS FOR SELECT WHERE clauses defined on tables. These clauses restrict which records an authenticated user can view. The vulnerability arises because the query engine evaluates user-supplied WHERE predicates against full record contents before applying permission filters. This inverted evaluation order allows a low-privileged authenticated user to construct predicates that leak protected field values through side effects.

The flaw extends beyond SELECT operations. Mutating statements such as UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE share the same evaluation ordering when processing SET, MERGE, CONTENT, and PATCH clauses. This broadens the attack surface across most SurrealQL data manipulation operations.

Root Cause

The root cause is an authorization sequencing error [CWE-863]. Permission enforcement is applied after predicate evaluation rather than before. Records that should be filtered out by PERMISSIONS FOR SELECT WHERE still flow through user-controlled expressions, exposing their contents to observation channels.

Attack Vector

An authenticated user issues a SurrealQL query containing a crafted WHERE clause referencing fields the user is not permitted to read. Three exfiltration paths exist. When scripting is enabled via --allow-scripting, embedded functions can directly return record contents. Without scripting, the THROW statement can be used to raise exceptions containing extracted field values in error messages. Finally, timing-based side channels allow oracle-style extraction of protected data one bit at a time by constructing predicates that vary execution time based on field values.

Code examples are not published in the vendor advisory. See the GitHub Security Advisory and VulnCheck Advisory for technical background.

Detection Methods for CVE-2026-63755

Indicators of Compromise

SurrealQL queries containing THROW statements referencing fields not visible under the user's declared permissions
Unusually high volumes of SELECT queries with complex or boolean-decomposed WHERE clauses from Record or Scope users
Query patterns consistent with binary search or bit-by-bit extraction against protected fields
Repeated queries with near-identical structure but incrementally varied literal values, suggesting timing oracle probing

Detection Strategies

Enable SurrealDB query logging and audit logs on all SELECT, UPDATE, UPSERT, INSERT, and RELATE statements from non-administrative users
Alert on any use of the THROW statement or embedded scripting functions when originating from Record or Scope user sessions
Baseline query duration per table and flag statistically anomalous latency distributions from authenticated user sessions

Monitoring Recommendations

Forward SurrealDB logs to a centralized analytics platform for correlation with authentication events
Track per-user query volume and predicate complexity to identify enumeration behavior
Monitor for the --allow-scripting runtime flag in deployment configurations and flag instances where it is enabled unnecessarily

How to Mitigate CVE-2026-63755

Immediate Actions Required

Upgrade all SurrealDB instances to version 3.1.0 or later
Disable --allow-scripting on any instance where scripting is not strictly required
Audit all Record and Scope user accounts and revoke access for accounts no longer in use
Review table-level PERMISSIONS definitions and confirm no sensitive data is protected solely by PERMISSIONS FOR SELECT WHERE filtering

Patch Information

SurrealDB fixed the ordering flaw in version 3.1.0. Refer to the GitHub Security Advisory GHSA-98fx-66cf-fc7c for the official fix details and upgrade instructions.

Workarounds

Run SurrealDB without --allow-scripting to eliminate the most direct exfiltration path
Restrict authentication to Namespace and Database users where feasible, avoiding Record and Scope user provisioning until patched
Segment sensitive data into dedicated databases or namespaces since the vulnerability does not cross those isolation boundaries
Apply network-level access controls to limit query origination to trusted application tiers

bash

# Start SurrealDB without scripting enabled
surreal start --user root --pass <password> file://data.db
# Verify version is 3.1.0 or later
surreal version