CVE-2026-63758 Overview
CVE-2026-63758 is an authorization bypass vulnerability in SurrealDB versions before 3.1.0. The flaw resides in the KILL statement handler, which fails to verify that the requesting user owns the target live query. Authenticated database users can issue KILL statements with arbitrary live query UUIDs to terminate other users' LIVE SELECT subscriptions. The vulnerability is tracked under CWE-862: Missing Authorization.
Critical Impact
Any authenticated user can terminate real-time data subscriptions belonging to other users, disrupting applications that depend on LIVE SELECT streams for event-driven workflows.
Affected Products
- SurrealDB versions prior to 3.1.0
- Applications relying on SurrealDB LIVE SELECT real-time subscriptions
- Multi-tenant deployments where multiple authenticated users share a database
Discovery Timeline
- 2026-07-20 - CVE-2026-63758 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-63758
Vulnerability Analysis
SurrealDB supports real-time subscriptions through LIVE SELECT queries, which return a UUID identifying the active subscription. Clients terminate their own subscriptions using the KILL <uuid> statement. In versions before 3.1.0, the KILL handler does not validate that the caller owns the live query referenced by the supplied UUID.
An authenticated user with any database-level role can execute KILL against a live query UUID belonging to a different user. The server terminates the target subscription without producing an authorization error. This breaks the isolation model expected between concurrent sessions.
The EPSS score of 0.181% reflects that no public exploit has been observed, though the operation requires only a valid live query UUID and standard authenticated access.
Root Cause
The root cause is a missing ownership check in the KILL statement execution path. The handler resolves the live query by UUID and cancels the associated stream without comparing the query's owner against the current session identity. This is a classic instance of CWE-862, where an operation with sensitive side effects lacks an authorization gate.
Attack Vector
Exploitation requires network access to a SurrealDB instance and valid authenticated credentials at the database scope. The attacker must obtain or guess a live query UUID belonging to another user. UUIDs may be exposed through application logs, error messages, shared telemetry, or client-side artifacts. Once obtained, the attacker issues a KILL <uuid> statement over any supported SurrealDB client protocol. The targeted subscription is terminated immediately, and dependent client logic stops receiving change notifications. Repeated exploitation can render live-data features unusable across an entire tenant.
See the SurrealDB GitHub Security Advisory GHSA-gcwr-5mrf-fvch and the VulnCheck Advisory for SurrealDB for further technical details.
Detection Methods for CVE-2026-63758
Indicators of Compromise
- Unexpected termination of LIVE SELECT subscriptions reported by application clients without a corresponding client-initiated KILL.
- SurrealDB query logs showing KILL statements issued by user sessions that did not create the referenced live query UUID.
- Elevated frequency of KILL statements originating from a single authenticated principal targeting UUIDs across multiple sessions.
Detection Strategies
- Correlate LIVE SELECT creation events with subsequent KILL events and alert when the issuing session identity differs from the creator.
- Enable verbose query auditing on SurrealDB and forward logs to a centralized analytics platform for behavioral analysis.
- Baseline the normal KILL rate per user and flag statistical outliers indicative of enumeration or targeted disruption.
Monitoring Recommendations
- Instrument client applications to report unexpected subscription closures back to a central telemetry service.
- Monitor for authenticated sessions issuing KILL statements against UUIDs they never observed in a LIVE SELECT response.
- Track database availability metrics for live-query-dependent features to detect user-visible impact quickly.
How to Mitigate CVE-2026-63758
Immediate Actions Required
- Upgrade all SurrealDB instances to version 3.1.0 or later, which enforces ownership checks on the KILL statement.
- Inventory database users with authenticated access and revoke credentials for accounts that do not require live-query capabilities.
- Rotate credentials for shared or service accounts that may have been exposed in multi-tenant environments.
Patch Information
The fix is included in SurrealDB 3.1.0. Refer to the SurrealDB GitHub Security Advisory GHSA-gcwr-5mrf-fvch for release notes and upgrade guidance. Verify the running version with surreal version after upgrade and restart all client connections to ensure new session semantics take effect.
Workarounds
- Restrict database-level authentication to trusted principals until the upgrade is applied, using per-tenant scopes where feasible.
- Avoid exposing live query UUIDs in application logs, error responses, or shared telemetry channels accessible to other tenants.
- Implement application-layer reconnection logic that automatically re-establishes LIVE SELECT subscriptions when unexpected termination is detected.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
