PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-63756 surrealdb CVE debrief

CVE-2026-63756 is a critical vulnerability in SurrealDB versions before 3.1.0. The issue is a time-of-check/time-of-use race condition in the HTTP /rpc endpoint. This allows unauthenticated attackers to send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active, potentially leading to the execution of operations with hijacked user privileges.

Vendor
surrealdb
Product
Unknown
CVSS
CRITICAL 9.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-20
Original CVE updated
2026-07-22
Advisory published
2026-07-20
Advisory updated
2026-07-22

Who should care

Organizations using SurrealDB versions before 3.1.0 should prioritize patching this vulnerability. The exploit involves sending concurrent requests to the /rpc endpoint, which could allow attackers to execute operations with hijacked user privileges. Given the critical severity (CVSS score of 9.2), immediate attention is required to mitigate potential risks.

Technical summary

The vulnerability exists in the HTTP /rpc endpoint of SurrealDB versions before 3.1.0. A time-of-check/time-of-use race condition allows unauthenticated attackers to hijack authenticated session state. By sending concurrent requests during active legitimate authenticated traffic, attackers can execute operations with elevated privileges. Organizations should assess their exposure, prioritize patching, and monitor for suspicious activity to mitigate potential risks associated with this critical vulnerability.

Defensive priority

High

Recommended defensive actions

  • Apply the patch: Upgrade to SurrealDB version 3.1.0 or later.
  • Implement compensating controls: Monitor and restrict concurrent requests to the /rpc endpoint.
  • Conduct inventory checks: Identify and update all instances of SurrealDB versions before 3.1.0.
  • Enhance monitoring: Track and analyze traffic to the /rpc endpoint for suspicious concurrent requests.
  • Exception tracking: Keep records of systems and applications using SurrealDB for swift remediation.

Evidence notes

The CVE record was published on 2026-07-20T12:19:45.590Z and was last modified on 2026-07-21T18:37:56.803Z. The NVD entry is currently Awaiting Analysis. Official references include the CVE.org record and the NVD detail page.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-63756 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-63756

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-63756 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-63756

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.