PatchSiren cyber security CVE debrief
CVE-2026-63756 surrealdb CVE debrief
CVE-2026-63756 is a critical vulnerability in SurrealDB versions before 3.1.0. The issue is a time-of-check/time-of-use race condition in the HTTP /rpc endpoint. This allows unauthenticated attackers to send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active, potentially leading to the execution of operations with hijacked user privileges.
- Vendor
- surrealdb
- Product
- Unknown
- CVSS
- CRITICAL 9.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-20
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-20
- Advisory updated
- 2026-07-22
Who should care
Organizations using SurrealDB versions before 3.1.0 should prioritize patching this vulnerability. The exploit involves sending concurrent requests to the /rpc endpoint, which could allow attackers to execute operations with hijacked user privileges. Given the critical severity (CVSS score of 9.2), immediate attention is required to mitigate potential risks.
Technical summary
The vulnerability exists in the HTTP /rpc endpoint of SurrealDB versions before 3.1.0. A time-of-check/time-of-use race condition allows unauthenticated attackers to hijack authenticated session state. By sending concurrent requests during active legitimate authenticated traffic, attackers can execute operations with elevated privileges. Organizations should assess their exposure, prioritize patching, and monitor for suspicious activity to mitigate potential risks associated with this critical vulnerability.
Defensive priority
High
Recommended defensive actions
- Apply the patch: Upgrade to SurrealDB version 3.1.0 or later.
- Implement compensating controls: Monitor and restrict concurrent requests to the /rpc endpoint.
- Conduct inventory checks: Identify and update all instances of SurrealDB versions before 3.1.0.
- Enhance monitoring: Track and analyze traffic to the /rpc endpoint for suspicious concurrent requests.
- Exception tracking: Keep records of systems and applications using SurrealDB for swift remediation.
Evidence notes
The CVE record was published on 2026-07-20T12:19:45.590Z and was last modified on 2026-07-21T18:37:56.803Z. The NVD entry is currently Awaiting Analysis. Official references include the CVE.org record and the NVD detail page.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-63756 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-63756
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-63756 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-63756
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-4vgr-h27g-cf9p
-
Source reference
Unverified legacy reference
URL: https://www.vulncheck.com/advisories/surrealdb-before-privilege-escalation-via-rpc-session-race-condition
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.