CVE-2026-102876 in SurrealDB
Summary
by MITRE • 09/29/2026
SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant's namespace and database to read, create, and modify records across tenant boundaries.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in SurrealDB versions prior to 3.3.0 represents a critical authorization bypass within the HTTP session construction mechanism. This flaw stems from an inconsistency between how authentication credentials are validated and how the resulting database sessions are initialized. Specifically, when processing incoming requests, the server utilizes the check_auth function to verify user identity by examining the Surreal-Auth-NS and Surreal-Auth-DB headers. These headers define the namespace and database context against which the provided credentials are checked for validity. However, upon successful authentication, the system constructs the active session using a different set of parameters derived from the Surreal-NS and Surreal-DB headers. This decoupling creates a significant security gap where the identity verification does not align with the operational scope granted to the authenticated user.
From a technical perspective, this discrepancy allows an attacker to perform tenant isolation violations in multi-tenant environments. An adversary can authenticate using valid credentials for one specific namespace and database combination but then manipulate the request headers to specify a different target namespace and database during session construction. Because the server does not validate that the selected operational context matches or is permitted relative to the authenticated identity, the attacker gains access to resources outside their intended scope. This effectively bypasses the multi-tenant security model designed into SurrealDB, allowing unauthorized users to interact with data belonging to other tenants as if they were legitimate administrators of those specific namespaces and databases.
The operational impact of this vulnerability is severe, particularly for deployments utilizing SurrealDB in a multi-tenant architecture where strict data isolation between customers or organizational units is required. Successful exploitation enables attackers to read sensitive records from unauthorized tenants, create new malicious entries within other tenants' spaces, and modify existing data. This leads to a complete compromise of confidentiality, integrity, and potentially availability for the affected tenant data. The ability to cross-tenant boundaries undermines trust in the database's security model and can result in significant regulatory compliance failures depending on the nature of the exposed data.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting a failure to enforce proper authorization checks during session initialization. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, as it involves leveraging legitimate credentials but abusing system logic to access unauthorized resources. To mitigate this risk, organizations running SurrealDB must upgrade immediately to version 3.3.0 or later where the session construction logic has been corrected to ensure that the operational namespace and database are strictly validated against the authenticated user's permissions. Until an update is applied, administrators should consider network-level restrictions such as IP whitelisting or WAF rules to limit exposure of the affected endpoints, although upgrading remains the only definitive remediation for this architectural flaw.