CVE-2026-109343 surrealdb CVE debrief

Who should care

Defenders responsible for SurrealDB deployments should assess exposure and prioritize remediation. This includes reviewing user permissions, access controls, and upgrading to version 3.3.0 or later.

Why it matters

CVE-2026-109343 is a high-severity vulnerability in SurrealDB before version 3.3.0, allowing cross-tenant access via the USE statement. Defenders should prioritize upgrading and reviewing user permissions.

• Authenticated users can access and manipulate data across tenants
• Potential for unauthorized data access and modifications
• Requires verification of current user permissions and access controls
• Upgrade to version 3.3.0 or later to mitigate the issue

Technical summary

The vulnerability exists in SurrealDB before version 3.3.0, where the USE statement in SurrealQL allows cross-tenant access. Authenticated users with namespace, database, or record permissions can switch to another tenant and perform operations based on the PERMISSIONS setting. This issue allows for potential unauthorized data access and modifications. Defenders should prioritize upgrading to SurrealDB version 3.3.0 or later and review current user permissions and access controls to mitigate the issue. The vulnerability's technical framing emphasizes the need for verification of current user permissions and access controls to prevent exploitation.

Defensive priority

Defenders should prioritize upgrading to SurrealDB version 3.3.0 or later and review current user permissions and access controls.

Recommended defensive actions

• Upgrade to SurrealDB version 3.3.0 or later
• Review and restrict user permissions and access controls
• Monitor for suspicious activity
• Perform a thorough review of current user permissions and access controls
• Verify that all users have the least privilege necessary
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions. However, additional information on potential exploitation or impact is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.