CVE-2026-109333 surrealdb CVE debrief

Who should care

Defenders responsible for SurrealDB deployments, particularly those with multi-tenant environments, should assess exposure and prioritize patching or mitigation to prevent potential data exposure.

Why it matters

CVE-2026-109333 is a high-severity vulnerability in SurrealDB that allows authenticated users to read records from other tenants. Defenders should prioritize patching or mitigating this vulnerability to prevent potential data exposure.

• Potential data exposure due to authorization bypass.
• Need to verify and update SurrealDB versions to 3.3.0 or later.
• Possible lateral movement within multi-tenant environments.

Technical summary

The vulnerability exists in SurrealDB versions 3.0.0 before 3.3.0, where an authenticated user can use a RETURN FETCH query to read records from other tenants. This is due to an authorization bypass that allows resolving record IDs across different namespaces or databases. The issue has a CVSS score of 7.1 and is considered HIGH severity. Defenders should prioritize patching or mitigating this vulnerability to prevent potential data exposure. Assess exposure by reviewing SurrealDB deployments and user access controls. The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability to prevent potential data exposure. Assess exposure by reviewing SurrealDB deployments and user access controls.

Recommended defensive actions

• Review and apply patches or updates to SurrealDB to ensure version 3.3.0 or later is used.
• Implement additional access controls and monitoring to detect and prevent unauthorized data access.
• Review user access controls and permissions to prevent exploitation.
• Verify SurrealDB deployments and user access controls to assess exposure.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories. However, there is limited information on exploitation or specific attack scenarios.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.