CVE-2026-109342 surrealdb CVE debrief

Who should care

Defenders responsible for SurrealDB deployments, particularly those using versions 3.0.0 through 3.2.x, should assess their exposure to this vulnerability and ensure proper authentication mechanisms are in place for RPC methods.

Why it matters

Defenders should prioritize verifying SurrealDB versions and ensuring proper authentication for RPC methods to prevent unauthorized revocation of refresh tokens and potential re-authentication requirements.

• Potential unauthorized revocation of refresh tokens
• Forced re-authentication for users
• Increased risk of authentication-related attacks
• Need for verification of SurrealDB versions and authentication mechanisms

Technical summary

The SurrealDB versions 3.0.0 before 3.3.0 contain a missing authentication vulnerability in the revoke RPC method. This vulnerability allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession, potentially forcing re-authentication. The vulnerability is particularly concerning for defenders who manage SurrealDB deployments, as it can lead to unauthorized revocation of refresh tokens and increased risk of authentication-related attacks. To mitigate this vulnerability, defenders should prioritize verifying the versions of SurrealDB in use and assessing exposure to the revoke RPC method.

Defensive priority

Defenders should prioritize verifying the versions of SurrealDB in use and assessing exposure to the revoke RPC method. This involves checking for any instances of SurrealDB running versions 3.0.0 through 3.2.x and ensuring that proper authentication mechanisms are in place for RPC methods.

Recommended defensive actions

• Verify SurrealDB versions in use and assess exposure to the revoke RPC method
• Ensure proper authentication mechanisms are in place for RPC methods
• Monitor for any unauthorized use of the revoke RPC method
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details about the vulnerability, including its existence in SurrealDB versions 3.0.0 before 3.3.0 and the potential impact of unauthenticated revocation of refresh tokens.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.