CVE-2026-109336 surrealdb CVE debrief

Who should care

Defenders responsible for SurrealDB deployments should assess exposure and prioritize verification and remediation efforts. This includes operators managing SurrealDB instances, platform administrators, vulnerability management teams, and security teams that need to ensure the security and integrity of their data. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-

Why it matters

CVE-2026-109336 is a field permission bypass vulnerability in SurrealDB before version 3.3.0 that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Defenders should prioritize verifying and upgrading to SurrealDB version 3.3.0 or later, perform inventory checks, and monitor for suspicious LIVE SELECT queries.

• Defenders need to verify and upgrade to SurrealDB version 3.3.0 or later to prevent unauthorized access to restricted fields.
• Inventory checks are necessary to identify SurrealDB versions before 3.3.0 that may be vulnerable to this exploit.
• Monitoring for suspicious LIVE SELECT queries can help detect potential attacks.
• Remediation priority is medium due to the potential for unauthorized data access.

Technical summary

The vulnerability allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive exact stored values in CREATE, UPDATE, and DELETE notifications. This issue affects SurrealDB deployments prior to version 3.3.0, where defenders need to verify and upgrade to prevent unauthorized access to restricted fields. The vulnerability can be mitigated by performing inventory checks and monitoring for suspicious LIVE SELECT queries.

Defensive priority

Defenders should prioritize verifying and upgrading to SurrealDB version 3.3.0 or later to mitigate this vulnerability. Inventory checks and monitoring for suspicious LIVE SELECT queries are recommended.

Recommended defensive actions

• Verify and upgrade to SurrealDB version 3.3.0 or later
• Inventory checks for SurrealDB versions before 3.3.0
• Monitor for suspicious LIVE SELECT queries
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE Program record and the NVD vulnerability detail page. The source item provides additional information about the vulnerability, including affected versions and references to vendor advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.