CVE-2026-109334 in SurrealDB
Summary
by MITRE • 10/12/2026
SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method to read, create, modify, and delete rows and read DEFINE PARAM values in another tenant where table PERMISSIONS allow it.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in SurrealDB versions prior to 3.3.0 represents a critical failure in access control logic within the database engine's authentication and session management subsystems. This flaw specifically targets the mechanism by which the system validates the scope of operations against the credentials used for initial authentication. In a properly secured multi-tenant environment, such as SurrealDB’s architecture where data is isolated into namespaces and databases, the server must strictly enforce that any operation performed by an authenticated user remains within the boundaries defined at the time of login. However, due to this implementation error, the database fails to verify whether the namespace or database specified in subsequent requests matches the level at which the system-level user originally authenticated. This lack of validation creates a direct path for privilege escalation and cross-tenant data leakage, fundamentally undermining the isolation guarantees expected by tenants sharing the same instance.
From a technical perspective, the exploitation vector relies on the manipulation of HTTP headers or Remote Procedure Call parameters to override default context settings. An attacker who has successfully authenticated as a namespace-level user can inject specific headers, namely Surreal-NS and Surreal-DB, into requests directed at the /sql endpoint. Alternatively, they may invoke the RPC use method with arbitrary values for these identifiers. Because the server does not cross-reference these injected parameters against the authentication token's scope, it accepts them as valid context switches. This allows the attacker to effectively impersonate a user belonging to a different tenant or namespace. Once this context switch is accepted without validation, the database proceeds to execute queries within that unauthorized target environment, treating the request as if it originated from an administrator or owner of that specific data partition.
The operational impact of this vulnerability is severe, particularly for organizations relying on SurrealDB for multi-tenant SaaS applications where strict data segregation is a contractual and regulatory requirement. An authenticated attacker can read sensitive information stored in other tenants' databases by executing SELECT queries against tables they do not own but which have permissions allowing public or broad access. Beyond passive reading, the flaw permits active manipulation of data; attackers can create new records, modify existing ones, or delete critical rows within foreign namespaces. Furthermore, the vulnerability extends to metadata exposure, as attackers can read DEFINE PARAM values from other tenants. This leakage of configuration parameters may reveal internal logic details, connection strings, or security policies that could facilitate further attacks against the broader infrastructure. The ability to alter data also poses significant risks for integrity and availability, potentially leading to financial loss or reputational damage depending on the nature of the stored information.
This issue aligns with CWE-269, Improper Privilege Management, as it involves a failure to enforce appropriate access control levels relative to user privileges. It is also categorized under CWE-732, Incorrect Permission Assignment for Critical Resource, because the database assigns permissions based on manipulated context rather than verified identity scope. In terms of offensive security frameworks, this vulnerability maps directly to MITRE ATT&CK technique T1098.004, SSH Authorized Key Manipulation, or more broadly T1530, Data from Cloud Storage Object, depending on the specific data exfiltration method used, but most accurately fits T1078, Valid Accounts, specifically regarding lateral movement and privilege escalation within a cloud environment by exploiting misconfigured access controls. The core issue is akin to path traversal in file systems or header injection leading to object reference manipulation in web applications, where user input dictates resource location without sufficient validation against the current session's authority.
Mitigation for this vulnerability requires immediate action on two fronts: technical remediation and architectural review. The primary defense is upgrading SurrealDB to version 3.3.0 or later, where the developers have implemented strict checks ensuring that namespace and database identifiers in requests match the authenticated user’s scope. For environments where an upgrade is not immediately feasible, administrators should implement a reverse proxy or API gateway layer that strips or validates these specific headers before they reach the database server. This intermediary service can enforce policy by rejecting any request containing Surreal-NS or Surreal-DB headers if the requesting IP or session does not originate from authorized administrative sources. Additionally, organizations should audit their table PERMISSIONS settings to ensure that sensitive data is never exposed with overly permissive access rules, thereby reducing the blast radius even if an attacker manages to bypass authentication checks. Regular security assessments and penetration testing focused on multi-tenant isolation are recommended to detect similar logic flaws in custom implementations or other database components.