CVE-2026-63756 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated session state. Unauthenticated attackers can send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active to execute operations with hijacked user privileges.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists within SurrealDB versions prior to 3.1.0 and represents a critical time-of-check/time-of-use race condition affecting the HTTP rpc endpoint. The flaw occurs when unauthenticated attackers exploit the timing gap between when access controls are checked and when the actual operation is executed, allowing them to hijack active authenticated sessions. The vulnerability specifically targets the rpc endpoint which handles remote procedure calls and enables attackers to inherit the privileges of legitimate authenticated users through concurrent request manipulation.
The technical implementation of this race condition stems from insufficient session state management during concurrent request processing. When multiple requests are processed simultaneously, the system checks authentication status at the beginning of the request cycle but fails to maintain consistent session state throughout the execution phase. This creates an opportunity for unauthenticated requests to access authenticated session data while legitimate users are actively using their sessions. The vulnerability is particularly dangerous because it operates without requiring any prior authentication credentials, making it accessible to anyone who can send HTTP requests to the affected endpoint.
The operational impact of this vulnerability is severe as it allows attackers to execute arbitrary operations with elevated privileges that belong to authenticated users. This includes but is not limited to data manipulation, unauthorized access to sensitive information, privilege escalation within the database system, and potential lateral movement within the network infrastructure. The hijacking of user privileges means that attackers can perform actions that would normally be restricted to authorized personnel, potentially leading to complete system compromise or data exfiltration.
Security practitioners should immediately upgrade to SurrealDB version 3.1.0 or later where this race condition has been addressed through proper session state management and concurrent request handling mechanisms. Additional mitigations include implementing strict access controls on the rpc endpoint, monitoring for unusual concurrent request patterns, and deploying network segmentation to limit exposure of the vulnerable endpoint. Organizations should also consider implementing rate limiting and request queuing mechanisms to reduce the likelihood of successful exploitation.
This vulnerability aligns with CWE-367 Time-of-Check Time-of-Use (TOCTOU) which is classified as a common weakness in software security design patterns. The issue also maps to ATT&CK technique T1078 Valid Accounts, as attackers can leverage legitimate user sessions to perform unauthorized operations. Furthermore, the vulnerability demonstrates characteristics of privilege escalation and session hijacking techniques that are commonly exploited in database security breaches, making it particularly concerning for organizations relying on SurrealDB for mission-critical applications. The race condition aspect highlights a fundamental flaw in concurrent processing design that affects not just this specific implementation but represents a broader category of vulnerabilities requiring careful consideration in multi-threaded or concurrent systems.