PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-63735 surrealdb CVE debrief

CVE-2026-63735 is a high-severity vulnerability in SurrealDB, a database management system. Versions before 3.2.0 fail to validate namespace and database scope in custom API routes. This oversight allows authenticated users to invoke endpoints in different namespaces or databases by specifying the target scope in the URL path. Consequently, attackers with valid credentials for any namespace or database can access custom API endpoints in other tenants, potentially reading sensitive data or triggering unintended operations.

Vendor
surrealdb
Product
Unknown
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-20
Original CVE updated
2026-07-22
Advisory published
2026-07-20
Advisory updated
2026-07-22

Who should care

System administrators and security professionals responsible for SurrealDB installations, particularly those using versions before 3.2.0, should be aware of this vulnerability. Given the high CVSS score of 8.6, indicating a high severity, immediate attention is advised to assess the risk and apply necessary patches or mitigations.

Technical summary

The vulnerability arises from inadequate validation of namespace and database scope in custom API routes within SurrealDB versions prior to 3.2.0. Authenticated users can exploit this by specifying a different namespace or database in the URL path of custom API endpoints. This could lead to unauthorized access to sensitive data or the execution of unintended operations across different tenants. The CVSS:4.0 vector is AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X, reflecting a high severity score.

Defensive priority

High

Recommended defensive actions

  • Inventory and assess SurrealDB installations for version 3.2.0 or later compliance.
  • Apply the patch or upgrade to SurrealDB version 3.2.0 or later.
  • Implement compensating controls such as monitoring and access restrictions.
  • Verify and enforce proper authentication and authorization mechanisms.
  • Conduct regular security audits and vulnerability assessments.

Evidence notes

The CVE record was published on 2026-07-20T12:19:42.563Z and was last modified on 2026-07-21T18:37:56.803Z. The NVD entry is currently Awaiting Analysis. Limited information is available about the specific exploits or attacks related to this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-63735 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-63735

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-63735 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-63735

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.