CVE-2026-63757 Overview
SurrealDB versions before 3.1.0 contain a session hijacking vulnerability in the HTTP /rpcsessions method. The endpoint returns attached session UUIDs without requiring authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate active session identifiers and impersonate authenticated users. Once an attacker adopts a valid session, they can read, write, and delete data across the database and escalate privileges. The flaw is tracked under CWE-306: Missing Authentication for Critical Function.
Critical Impact
Unauthenticated network attackers can hijack authenticated SurrealDB sessions to gain full read, write, and delete access to database contents and escalate privileges.
Affected Products
- SurrealDB versions prior to 3.1.0
- Deployments exposing the HTTP /rpc endpoint on the network
- Self-hosted and containerized SurrealDB instances built on affected releases
Discovery Timeline
- 2026-07-20 - CVE-2026-63757 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-63757
Vulnerability Analysis
SurrealDB exposes a JSON-RPC interface at the HTTP /rpc path for interacting with database sessions. The sessions method on this interface returns the UUIDs of attached sessions without validating the caller's authentication state. An unauthenticated client connecting to the endpoint can enumerate live session identifiers belonging to legitimate users.
Beyond enumeration, the sessions handler accepts arbitrary session fields without verifying that the caller owns the referenced session. This absence of ownership checks allows an attacker to attach to or modify another user's session context. The vulnerability aligns with [CWE-306], where a critical function is reachable without authentication.
Exploitation results in full impersonation of authenticated sessions. Because SurrealDB sessions carry authorization state, hijacked sessions inherit the target's privileges, including administrative roles when the impersonated user is privileged. Attack complexity is low and no privileges are required, though limited user interaction is a factor.
Root Cause
The root cause is missing authentication and missing ownership verification on the /rpcsessions method. Session UUIDs are treated as non-sensitive metadata, and session field mutations are accepted without correlating them to the requesting principal.
Attack Vector
An attacker sends a JSON-RPC request to the /rpc endpoint invoking the sessions method over the network. The response discloses attached session UUIDs. The attacker then issues follow-up sessions calls with crafted session fields to impersonate an existing authenticated session, after which subsequent RPC calls execute in the victim's authorization context.
No credentials, tokens, or prior access are required. The endpoint must be network-reachable to the attacker, which is common for SurrealDB deployments exposing HTTP APIs to application tiers or the internet.
See the SurrealDB GitHub Security Advisory GHSA-5qfp-32cf-69jh and the VulnCheck Advisory for additional protocol-level detail.
Detection Methods for CVE-2026-63757
Indicators of Compromise
- Unauthenticated HTTP POST requests to the /rpc endpoint invoking the sessions method from unexpected source addresses.
- Repeated sessions RPC calls originating from a single client, consistent with UUID enumeration.
- Session activity where the source IP or user-agent changes mid-session without a corresponding re-authentication event.
- Privileged database operations executed by sessions that were previously idle or associated with lower-privileged roles.
Detection Strategies
- Inspect SurrealDB HTTP access logs for /rpc traffic and correlate sessions method calls with authentication events.
- Deploy WAF or reverse-proxy rules that flag JSON-RPC bodies containing the sessions method from unauthenticated sources.
- Baseline normal RPC call patterns per client and alert on high-frequency sessions invocations.
Monitoring Recommendations
- Forward SurrealDB and fronting proxy logs to a centralized analytics platform for retention and correlation.
- Monitor for concurrent use of the same session UUID from geographically distinct IP addresses.
- Alert on newly observed clients issuing /rpc traffic outside of documented application service accounts.
How to Mitigate CVE-2026-63757
Immediate Actions Required
- Upgrade SurrealDB to version 3.1.0 or later on all affected instances.
- Restrict network exposure of the /rpc endpoint to trusted application tiers using firewall or service mesh policies.
- Rotate credentials and invalidate existing sessions after patching to eliminate any hijacked sessions that may persist.
- Review database audit logs for anomalous session activity dating back to the deployment of affected versions.
Patch Information
SurrealDB 3.1.0 remediates the issue. Refer to the vendor advisory at GHSA-5qfp-32cf-69jh for release notes and upgrade instructions.
Workarounds
- Place SurrealDB behind an authenticating reverse proxy that blocks unauthenticated requests to /rpc.
- Disable or block the HTTP /rpc interface at the network layer if it is not required by applications.
- Enforce strict allowlists so only known application service identities can reach the SurrealDB HTTP API.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
