CVE-2026-63756 surrealdb CVE debrief

Who should care

Organizations using SurrealDB versions before 3.1.0 should prioritize patching this vulnerability. The exploit involves sending concurrent requests to the /rpc endpoint, which could allow attackers to execute operations with hijacked user privileges. Given the critical severity (CVSS score of 9.2), immediate attention is required to mitigate potential risks.

Technical summary

The vulnerability exists in the HTTP /rpc endpoint of SurrealDB versions before 3.1.0. A time-of-check/time-of-use race condition allows unauthenticated attackers to hijack authenticated session state. By sending concurrent requests during active legitimate authenticated traffic, attackers can execute operations with elevated privileges. Organizations should assess their exposure, prioritize patching, and monitor for suspicious activity to mitigate potential risks associated with this critical vulnerability.

Defensive priority

High

Recommended defensive actions

• Apply the patch: Upgrade to SurrealDB version 3.1.0 or later.
• Implement compensating controls: Monitor and restrict concurrent requests to the /rpc endpoint.
• Conduct inventory checks: Identify and update all instances of SurrealDB versions before 3.1.0.
• Enhance monitoring: Track and analyze traffic to the /rpc endpoint for suspicious concurrent requests.
• Exception tracking: Keep records of systems and applications using SurrealDB for swift remediation.

Evidence notes

The CVE record was published on 2026-07-20T12:19:45.590Z and was last modified on 2026-07-21T18:37:56.803Z. The NVD entry is currently Awaiting Analysis. Official references include the CVE.org record and the NVD detail page.

Official resources