CVE-2026-121419 in SurrealDB
Summary
by MITRE • 11/03/2026
SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's mcp-session-id can hijack the session and execute MCP tools with the victim's roles and permissions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in SurrealDB versions prior to 3.3.0 represents a critical flaw in the authentication and authorization logic governing Multi-Cloud Protocol (MCP) interactions, specifically within the BoundSubject fingerprinting mechanism. This issue stems from an improper implementation of identity verification where the system relies on the access method name rather than unique per-user identifiers when validating JWT or Bearer tokens for MCP sessions. In a secure architecture, session binding must ensure that the entity initiating the request is strictly authenticated and authorized as the specific user associated with the token. However, in this flawed implementation, the fingerprinting process fails to distinguish between different users who might be utilizing the same access method type. This oversight creates a significant gap in identity resolution, allowing an attacker to bypass intended security controls by exploiting the lack of granular user-specific validation during session establishment and maintenance.
From a technical perspective, the core defect lies in how the BoundSubject is constructed and verified. When a client connects via JWT or Bearer authentication, SurrealDB generates a fingerprint based on the access method name rather than incorporating unique elements such as the subject claim from the JWT or other user-specific metadata. This means that if an attacker possesses a valid low-privilege token for a specific access method and can obtain the mcp-session-id of a victim who is using the same access method, they can effectively hijack the session. The system incorrectly treats the new connection as belonging to the existing session because it only checks the broad category of the access method rather than verifying that the user identity matches the one originally authenticated for that session ID. This allows the attacker to execute MCP tools with the elevated roles and permissions assigned to the victim, effectively escalating privileges without needing valid credentials for those higher-level actions.
The operational impact of this vulnerability is severe, as it facilitates unauthorized access to sensitive data and functionality within the SurrealDB environment. An attacker who successfully exploits this flaw can impersonate a legitimate user, gaining full control over their session context. This includes the ability to read, modify, or delete database records that are restricted by role-based access controls (RBAC). Furthermore, since MCP tools often interact with external systems or perform complex operations, an attacker could leverage these tools to execute commands beyond what their own low-privilege token would normally permit. This not only compromises data confidentiality and integrity but also poses a risk to system availability if the executed actions are destructive or resource-intensive. The ability to hijack sessions means that any action taken under the victim's identity is logged as such, potentially complicating forensic analysis and accountability efforts while allowing persistent unauthorized access until the session expires or is manually terminated.
This vulnerability aligns with CWE-287, which describes Improper Authentication, specifically where an actor is able to impersonate another by failing to properly distinguish between different identities within a shared authentication context. It also relates closely to CWE-384, Session Fixation, as the attacker leverages a valid session identifier associated with a higher-privilege user to gain unauthorized access. In terms of the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts and potentially T1528 Steal Application Access Token if JWT tokens are intercepted or reused improperly in conjunction with the session ID. The exploitation path involves initial acquisition of a low-privilege token and the victim's session identifier, followed by session hijacking to achieve privilege escalation within the application layer.
To mitigate this vulnerability, organizations running SurrealDB versions from 3.1.0 up to but not including 3.3.0 must upgrade immediately to version 3.3.0 or later where these authentication checks have been corrected. The fix ensures that session binding correctly incorporates per-user identity elements into the fingerprinting process, thereby preventing cross-user session hijacking via shared access methods. Until an upgrade is possible, administrators should implement strict network-level controls such as IP whitelisting for MCP endpoints to limit exposure and enforce short-lived token expiration policies to reduce the window of opportunity for attackers. Additionally, monitoring logs for unusual patterns in session usage or unexpected privilege escalations can help detect potential exploitation attempts early. It is also advisable to review access method configurations to ensure that no single method type is overly broad without additional contextual validation mechanisms like mutual TLS or stricter JWT claim verification at the gateway level if direct upgrade is delayed.