CVE-2026-63756: SurrealDB Race Condition Vulnerability

CVE-2026-63756 Overview

CVE-2026-63756 is a time-of-check/time-of-use (TOCTOU) race condition affecting SurrealDB versions before 3.1.0. The flaw resides in the HTTP /rpc endpoint, where unauthenticated requests can inherit authenticated session state from concurrent legitimate traffic. Attackers exploit this by sending unauthenticated requests to /rpc while authenticated sessions are active, executing operations with hijacked user privileges. The vulnerability is tracked as CWE-362 and carries a CVSS 4.0 score of 9.2.

Critical Impact
Unauthenticated network attackers can hijack authenticated user privileges on SurrealDB instances, compromising database confidentiality, integrity, and availability.

Affected Products

SurrealDB versions prior to 3.1.0
Deployments exposing the HTTP /rpc endpoint
Multi-tenant SurrealDB instances handling concurrent authenticated sessions

Discovery Timeline

2026-07-20 - CVE-2026-63756 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63756

Vulnerability Analysis

SurrealDB exposes an HTTP /rpc endpoint for remote procedure calls against the database. The endpoint contains a race condition in how it associates incoming requests with session authentication state. When authenticated traffic is in flight, the server transiently exposes session context that concurrent unauthenticated requests can bind to. An attacker sending high-frequency unauthenticated requests during periods of legitimate activity can win the race and execute RPC operations under a valid user identity.

The result is a privilege escalation from unauthenticated network attacker to whichever authenticated principal the attacker manages to inherit. Because SurrealDB users often hold broad rights over records, functions, and schema, the impact spans data theft, tampering, and destructive operations.

Root Cause

The root cause is a TOCTOU flaw in session state handling within the /rpc handler. Authentication validation and the use of the resulting session context are not atomic. Session lookup and request execution occur in separate steps that concurrent requests can interleave, allowing an unauthenticated request to observe and reuse an authenticated session that belongs to another caller.

Attack Vector

The attack requires network access to the SurrealDB HTTP interface and the presence of concurrent authenticated traffic. The attacker submits parallel unauthenticated requests to /rpc and relies on timing to inherit an active session. Attack complexity is high because success depends on race timing and observable authenticated activity, but no credentials, privileges, or user interaction are required. Refer to the VulnCheck Privilege Escalation Advisory for further technical context.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-4vgr-h27g-cf9p for vendor-supplied details.

Detection Methods for CVE-2026-63756

Indicators of Compromise

Bursts of concurrent HTTP requests targeting the /rpc endpoint from unauthenticated or unexpected source IPs
RPC operations executed against records or namespaces that do not match the source's typical access patterns
SurrealDB audit entries showing session identifiers being reused across disparate client addresses

Detection Strategies

Baseline normal /rpc request rates per client and alert on statistical anomalies indicating race-condition probing
Correlate authentication events with subsequent RPC actions to identify operations executed without a preceding authentication for that source
Inspect reverse proxy or WAF logs for parallel request patterns with identical or near-identical timestamps targeting /rpc

Monitoring Recommendations

Enable verbose logging on SurrealDB and forward events to a centralized SIEM for correlation
Monitor network telemetry for unauthenticated clients issuing sustained high-volume requests to database HTTP endpoints
Track schema, user, and permission changes to detect unauthorized administrative actions performed through hijacked sessions

How to Mitigate CVE-2026-63756

Immediate Actions Required

Upgrade SurrealDB to version 3.1.0 or later on all production and non-production instances
Restrict network exposure of the HTTP /rpc endpoint to trusted clients using firewalls or private networking
Rotate credentials and API tokens for any SurrealDB principal whose session may have been hijacked

Patch Information

SurrealDB has addressed the race condition in version 3.1.0. Details are available in the GitHub Security Advisory GHSA-4vgr-h27g-cf9p. Operators running any release prior to 3.1.0 must upgrade to receive the fix.

Workarounds

Place SurrealDB behind an authenticating reverse proxy that enforces client authentication before requests reach /rpc
Disable or block external access to the HTTP /rpc endpoint where the WebSocket or embedded interfaces can serve application needs
Apply strict rate limiting on /rpc to reduce the feasibility of winning the timing race

bash

# Example: restrict /rpc to a trusted subnet using an nginx reverse proxy
location /rpc {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://surrealdb_upstream;
}