CVE-2026-109340 surrealdb CVE debrief

Who should care

Defenders and administrators of SurrealDB instances, especially those with delete permissions on referenced tables, should assess exposure and prioritize patching. This includes reviewing compensating controls for exposed systems, monitoring for suspicious activity, and verifying patching and configuration to prevent potential unauthorized edge deletions and data integrity impacts.

Why it matters

CVE-2026-109340 is a medium-severity authorization bypass vulnerability in SurrealDB that allows authenticated users to delete protected graph edges. Defenders should prioritize patching and verifying instances, especially those with delete permissions on referenced tables, to prevent potential unauthorized edge deletions and data integrity impacts.

• Potential unauthorized deletion of graph edges
• Bypass of permission checks for edge cleanup
• Required verification of patching and configuration
• Possible impact on data integrity and availability

Technical summary

The vulnerability allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE in SurrealDB versions 3.1.0 before 3.3.0. This allows for potential unauthorized deletion of graph edges and bypass of permission checks for edge cleanup. Defenders should prioritize verifying and patching vulnerable instances, especially those with delete permissions on referenced tables, to prevent potential data integrity impacts. The vulnerability has a medium severity and requires verification of patching and configuration.

Defensive priority

Defenders should prioritize verifying and patching vulnerable SurrealDB instances, especially those with delete permissions on referenced tables.

Recommended defensive actions

• Verify and patch vulnerable SurrealDB instances to version 3.3.0 or later
• Restrict delete permissions on referenced tables to prevent unauthorized edge deletion
• Monitor for suspicious activity related to graph edge deletions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information on exploitation and impact is limited. There is no evidence of public exploitation, but defenders should verify patching and configuration to prevent potential unauthorized edge deletions. The source item and CVE record provide source-provided CVE metadata and vulnerability details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.