PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-63738 surrealdb CVE debrief

CVE-2026-63738 is a medium-severity vulnerability in SurrealDB versions 3.1.0 before 3.1.5. The issue allows attackers with table-level SELECT access to read field values hidden by field-level permissions through graph-edge or back-reference traversals. This vulnerability can potentially lead to unauthorized data access. Users of SurrealDB versions 3.1.0 before 3.1.5 should assess their exposure and apply patches to prevent potential data breaches.

Vendor
surrealdb
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-20
Original CVE updated
2026-07-22
Advisory published
2026-07-20
Advisory updated
2026-07-22

Who should care

Users of SurrealDB versions 3.1.0 before 3.1.5 should assess their exposure and apply patches to prevent potential data breaches. This includes reviewing and enforcing strict field-level permissions, monitoring for suspicious graph traversal activities, and inventorying and auditing SurrealDB instances for compliance.

Technical summary

SurrealDB versions 3.1.0 before 3.1.5 do not enforce field-level SELECT permissions during graph-edge or back-reference traversals. This allows attackers with table-level SELECT access to bypass field-level permissions and access restricted data. The vulnerability is a result of inadequate access control mechanisms in the affected versions of SurrealDB. Users of SurrealDB should assess their exposure, review and enforce strict field-level permissions, monitor for suspicious activities, and apply patches to prevent potential data breaches. This issue can lead to unauthorized data access, emphasizing the need for prompt remediation and enhanced security measures.

Defensive priority

Medium

Recommended defensive actions

  • Apply the patch to upgrade SurrealDB to version 3.1.5 or later
  • Review and enforce strict field-level permissions in SurrealDB
  • Monitor for suspicious graph traversal activities
  • Inventory and audit SurrealDB instances for compliance
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-20T12:19:43.000Z and was last modified on 2026-07-21T18:37:56.803Z. The NVD entry is currently Awaiting Analysis. This information is based on the provided source corpus. Further verification is recommended to confirm the accuracy of this information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-63738 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-63738

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-63738 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-63738

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.