CVE-2026-63758 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions of other users without ownership verification.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists within SurrealDB versions prior to 3.1.0 and represents a critical authorization bypass flaw that undermines the database's security model. The issue specifically affects the KILL statement functionality which is designed to terminate active database operations, but fails to implement proper access controls when processing target identifiers for LIVE SELECT subscriptions. The flaw allows any authenticated user to execute KILL commands against live query UUIDs belonging to other users, effectively enabling unauthorized disruption of real-time data feeds and continuous queries that other database participants have initiated.
The technical implementation of this vulnerability stems from insufficient validation mechanisms within the KILL statement processor. When a user submits a KILL command targeting a specific UUID, the system should verify that the requesting user has either direct ownership of the target subscription or possesses elevated privileges to terminate operations belonging to other users. However, in affected versions, this authorization check is either completely omitted or inadequately implemented, allowing any authenticated database connection to issue termination commands against arbitrary live query identifiers. This represents a classic violation of the principle of least privilege and demonstrates poor access control implementation that aligns with CWE-284 access control vulnerabilities.
The operational impact of this vulnerability extends beyond simple disruption of data flows and creates significant security implications for real-time database applications. Attackers can exploit this flaw to systematically terminate legitimate user sessions, causing service interruptions and potentially leading to data loss or application instability when continuous queries are abruptly ended. The vulnerability particularly affects collaborative environments where multiple users maintain active subscriptions to the same datasets, as it enables malicious actors to degrade service quality for other participants without requiring elevated administrative credentials.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1496 which involves resource hijacking through unauthorized process termination. The flaw allows attackers to consume system resources and disrupt legitimate user activities while remaining undetected due to the lack of proper auditing or logging mechanisms that would normally flag unauthorized termination attempts. Organizations utilizing SurrealDB for real-time analytics, monitoring systems, or collaborative data applications face significant risk from this vulnerability as it enables attackers to create denial-of-service conditions against legitimate users.
The recommended mitigations include upgrading to SurrealDB version 3.1.0 or later where proper authorization checks have been implemented for the KILL statement functionality. Administrators should also implement additional monitoring controls to detect unusual patterns of KILL operations, particularly those targeting multiple UUIDs or occurring at high frequency. Network segmentation and access control policies should be reviewed to limit the scope of authenticated users who can initiate LIVE SELECT operations, thereby reducing the attack surface for this particular vulnerability while maintaining legitimate operational requirements.