CVE-2026-109335 in SurrealDB
Summary
by MITRE • 10/12/2026
SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN clauses with $before/$after to expose hidden values.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
SurrealDB versions prior to 3.3.0 contain a critical information disclosure vulnerability that undermines the integrity of field-level access controls through the manipulation of computed fields and transaction return statements. This flaw allows authenticated users who possess only record-level read permissions to bypass restrictions designed to hide specific sensitive data within database records. The core issue stems from how SurrealDB processes COMPUTED fields, which are dynamic values derived from other existing fields in a record rather than being stored directly as static columns. While the underlying source fields may be protected by strict SELECT permissions that prevent unauthorized users from reading their raw values, the computed field itself is often treated as a distinct entity with its own permission set or default visibility rules.
The primary vector for this exploitation involves attackers selecting records where the COMPUTED field references hidden data. Even if the user lacks explicit read access to the source fields containing sensitive information such as personal identifiers or financial details, they can request the computed field in their query results. Since the database engine must calculate and return the value of the computed field to fulfill the SELECT statement, it inadvertently exposes the underlying secret values during this calculation process. This effectively creates a side-channel through which restricted data leaks out, rendering the intended access control mechanisms ineffective for any data referenced by such dynamic fields.
A secondary exploitation method involves the use of write operations with RETURN clauses that include $before or $after variables. When an authenticated user performs an update or insert operation and requests to return the state of the record before or after the change, SurrealDB may populate these variables with full record data including hidden fields if they are part of the computed structure or referenced indirectly. This allows attackers to extract sensitive information during routine write operations without needing direct read access to the protected columns. The vulnerability persists because the database does not sufficiently filter out restricted fields when constructing return payloads for transactional feedback mechanisms, leading to unintended data exposure across both read and write pathways.
From a classification perspective, this vulnerability aligns with CWE-209 Generation of Error Message Containing Sensitive Information as well as CWE-778 Insufficient Logging or Monitoring if the leak occurs during error handling, but more accurately fits CWE-613 Insufficient Session Expiration given it is an authentication bypass for data access. In terms of MITRE ATT&CK framework tactics, this behavior corresponds to Tactic TA0009 Collection and specifically Technique T1005 Data from Local System or T1213 Data from Information Repositories where the attacker leverages application logic flaws rather than system-level exploits to gather intelligence on stored data. The impact is severe as it compromises confidentiality guarantees provided by the database engine, potentially leading to regulatory non-compliance and loss of user trust if personally identifiable information or proprietary business data is exposed.
Mitigation strategies require immediate upgrading SurrealDB to version 3.3.0 or later where these permission checks have been hardened for computed fields and return clauses. Until an upgrade is feasible, administrators should audit their database schema to identify any COMPUTED fields that reference sensitive columns and consider removing those dependencies if the dynamic calculation logic can be moved to application-level code with proper access control enforcement there. Additionally, restricting write operations that utilize RETURN $before or $after for users who do not require such detailed transactional feedback can reduce the attack surface. Security teams should also implement strict input validation on query structures and monitor logs for unusual patterns of field selection that might indicate probing for these specific leakage vectors.