CVE-2026-109334 in SurrealDB
Tóm tắt
Bởi MITRE • 12/10/2026
SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method to read, create, modify, and delete rows and read DEFINE PARAM values in another tenant where table PERMISSIONS allow it.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.