CVE-2026-63738 surrealdb CVE debrief

Who should care

Users of SurrealDB versions 3.1.0 before 3.1.5 should assess their exposure and apply patches to prevent potential data breaches. This includes reviewing and enforcing strict field-level permissions, monitoring for suspicious graph traversal activities, and inventorying and auditing SurrealDB instances for compliance.

Technical summary

SurrealDB versions 3.1.0 before 3.1.5 do not enforce field-level SELECT permissions during graph-edge or back-reference traversals. This allows attackers with table-level SELECT access to bypass field-level permissions and access restricted data. The vulnerability is a result of inadequate access control mechanisms in the affected versions of SurrealDB. Users of SurrealDB should assess their exposure, review and enforce strict field-level permissions, monitor for suspicious activities, and apply patches to prevent potential data breaches. This issue can lead to unauthorized data access, emphasizing the need for prompt remediation and enhanced security measures.

Defensive priority

Medium

Recommended defensive actions

• Apply the patch to upgrade SurrealDB to version 3.1.5 or later
• Review and enforce strict field-level permissions in SurrealDB
• Monitor for suspicious graph traversal activities
• Inventory and audit SurrealDB instances for compliance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-20T12:19:43.000Z and was last modified on 2026-07-21T18:37:56.803Z. The NVD entry is currently Awaiting Analysis. This information is based on the provided source corpus. Further verification is recommended to confirm the accuracy of this information.

Official resources