These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-109343 is a high-severity vulnerability in SurrealDB before version 3.3.0, allowing cross-tenant access via the USE statement. This issue enables authenticated users to switch to another tenant and perform read, create, update, or delete operations on tables with specific permissions. Affected deployments should be reviewed for exposure, and defenders should prioritize upgrading to version 3.3.0 [truncated]
A missing authentication vulnerability exists in SurrealDB versions 3.0.0 before 3.3.0 in the revoke RPC method. This allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession. The vulnerability impacts users of SurrealDB who have not upgraded to version 3.3.0 or later. Defenders should assess their exposure and ensure proper authentication mech [truncated]
CVE-2026-109340 is an authorization bypass vulnerability in SurrealDB versions 3.1.0 before 3.3.0. Authenticated users can delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE, allowing them to erase edges despite the edge table's PERMISSIONS FOR delete clause. This vulnerability has a medium severity and defenders should prioritize verifying and patching vulnerable instances. The vuln [truncated]
A memory exhaustion vulnerability exists in SurrealDB versions 3.1.0 before 3.3.0 due to unbounded buffering of Surrealism module output in host memory. This can be exploited by an attacker to crash the server, denying service to all namespaces and databases. The vulnerability is caused by the lack of proper output buffering limits in the Surrealism module, allowing an attacker to write output without new [truncated]
A denial of service vulnerability exists in SurrealDB before version 3.3.0. Users with query capabilities can crash the server by reading non-ASCII header values in embedded JavaScript, potentially disrupting service. This issue affects SurrealDB deployments and defenders should assess exposure and prioritize updates to version 3.3.0 or later. The vulnerability allows query-capable users to crash the serv [truncated]
CVE-2026-109337 is a field permission bypass vulnerability in SurrealDB before version 3.3.0. This vulnerability allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are delivered on CREATE, UPDATE, or DELETE to confirm or narrow restricted field values.
CVE-2026-109336 is a field permission bypass vulnerability in SurrealDB before version 3.3.0. This vulnerability allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive exact stored values in CREATE, UPDATE, and DELETE notifications.
CVE-2026-109335 is an information disclosure vulnerability in SurrealDB versions 3.0.0 before 3.3.0. The vulnerability allows users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields or use write RETURN clauses with $before/$after to expose hidden values.
CVE-2026-109334 is a high-severity vulnerability in SurrealDB before version 3.3.0, allowing cross-tenant access via Surreal-NS/Surreal-DB headers and RPC use. An authenticated attacker can exploit this vulnerability to read, create, modify, and delete rows and read DEFINE PARAM values in another tenant where table PERMISSIONS allow it. This vulnerability has a CVSS score of 8.6 and is considered HIGH sev [truncated]
CVE-2026-109333 is a high-severity vulnerability in SurrealDB versions 3.0.0 before 3.3.0. An authenticated user can exploit this vulnerability to read records from other tenants by using a RETURN FETCH query. This issue arises from an authorization bypass that allows users to resolve record IDs across different namespaces or databases. The vulnerability has a CVSS score of 7.1 and is considered HIGH seve [truncated]
CVE-2026-63763 is a confused deputy privilege escalation vulnerability in SurrealDB before 2.5.0 and before 3.0.0-beta.3. The vulnerability allows unprivileged users to create or modify fields containing futures, functions, or closures, which can be executed with higher-privileged user permissions. This can lead to full privilege escalation, including creation of a root owner and server takeover. Users of [truncated]
CVE-2026-63760 is a denial-of-service vulnerability in SurrealDB before version 3.1.0. The vulnerability occurs because the configured recursion depth limit is not enforced in the value and JSON parser when processing nested braces, brackets, or parentheses. This allows unauthenticated attackers to send deeply nested JSON payloads to the WebSocket /rpc endpoint, exhausting server memory and crashing the p [truncated]
CVE-2026-63759 is a high-severity vulnerability in SurrealDB before version 3.1.0. The issue arises from the failure to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can exploit this by sending queries with deeply nested type annotations, leading to server memory exhaustion and process crashes.
CVE-2026-63758 is an authorization bypass vulnerability in SurrealDB versions before 3.1.0. The vulnerability allows authenticated database users to terminate other users' LIVE SELECT subscriptions by issuing KILL statements with target live query UUIDs without ownership verification. This issue affects SurrealDB deployments where multiple users have access to the database, potentially disrupting real-tim [truncated]
CVE-2026-63757 is a session hijacking vulnerability in SurrealDB versions before 3.1.0. The HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. This allows unauthenticated attackers to enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges. The vulner [truncated]
CVE-2026-63756 is a critical vulnerability in SurrealDB versions before 3.1.0. The issue is a time-of-check/time-of-use race condition in the HTTP /rpc endpoint. This allows unauthenticated attackers to send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active, potentially leading to the execution of operations with hijacked user privileges.
CVE-2026-63754 is a denial of service vulnerability in SurrealDB versions before 3.1.0. An authenticated user with select permission can cause all CREATE, UPDATE, and DELETE operations on a table to fail by registering a LIVE query that triggers evaluation errors. This can lead to significant disruption of database operations. Users should be aware of this vulnerability and take steps to mitigate it.
CVE-2026-63753 is a vulnerability in SurrealDB before version 3.1.0. The issue causes the database to fail refreshing authentication state in LIVE SELECT subscriptions when session state changes. As a result, attackers can continue receiving real-time notifications under revoked or expired session credentials until the connection closes. The CVSS score for this vulnerability is 5.3, classified as MEDIUM s [truncated]
SurrealDB versions before 3.1.0 have a vulnerability in their WebSocket implementation. The SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit is not applied to anonymous /sql WebSocket connections. This allows attackers to send large WebSocket frames, potentially leading to memory amplification and degradation of /sql availability. The vulnerability can be exploited by streaming large WebSocket frames across multi [truncated]
CVE-2026-63749 is an authentication bypass vulnerability in SurrealDB versions before 3.1.0. The vulnerability exists in LIVE SELECT subscriptions where permission expressions referencing $value, $before, $after, or $event are evaluated against attacker-controlled bindings instead of actual documents. This allows authenticated subscribers to bind chosen values to these parameter names and register LIVE SE [truncated]
CVE-2026-63748 is an information disclosure vulnerability in SurrealDB versions before 3.1.0. Authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. The vulnerability is triggered by arithmetic or extend operations on hidden fields, embedding raw operand values in error responses and bypassing field-level access controls. This vulnerab [truncated]
A server-side request forgery vulnerability was discovered in SurrealDB before version 3.1.5. The vulnerability exists in the JWKS fetcher, which follows HTTP redirects without re-validating redirect targets against network capabilities. This allows attackers with Owner role to configure a JWKS URL pointing to an allowlisted host that redirects to blocked internal addresses, bypassing network access contr [truncated]
CVE-2026-63743 is a capability bypass vulnerability in SurrealDB before 3.1.0. An authenticated user can exploit this vulnerability to circumvent port-scoped --deny-net rules by chaining an HTTP redirect from an allowed hostname to a denied host:port combination. The redirect is followed because the port information is dropped during redirect policy evaluation. This vulnerability has a CVSS score of 5.3 a [truncated]
CVE-2026-63742 is a field-level SELECT permission bypass vulnerability in SurrealDB versions before 3.1.0. This issue affects indexed COUNT fast paths, allowing attackers to execute COUNT queries on indexed fields with field-level SELECT restrictions. This can lead to the confirmation or recovery of restricted field values through repeated guesses. The CVSS score for this vulnerability is 5.3, with a seve [truncated]
SurrealDB versions before 3.1.4 have a vulnerability where record users can read array elements that should be denied by exploiting incorrect index handling during permission filtering. This issue allows attackers with record scope access to access sensitive data. The vulnerability arises from a flaw in the permission filtering mechanism for array elements, potentially leading to unauthorized access to se [truncated]
CVE-2026-63739 is an arbitrary file read vulnerability in SurrealDB before 3.1.5. The vulnerability exists in the DEFINE ANALYZER mapper filter and allows database users with EDITOR or OWNER roles to read files accessible to the SurrealDB process. Attackers can specify arbitrary file paths in the mapper filter and retrieve file contents through query error messages when the SURREAL_FILE_ALLOWLIST is empty [truncated]
CVE-2026-63738 is a medium-severity vulnerability in SurrealDB versions 3.1.0 before 3.1.5. The issue allows attackers with table-level SELECT access to read field values hidden by field-level permissions through graph-edge or back-reference traversals. This vulnerability can potentially lead to unauthorized data access. Users of SurrealDB versions 3.1.0 before 3.1.5 should assess their exposure and apply [truncated]
CVE-2026-63737 is a denial of service vulnerability in SurrealDB versions before 3.1.5. Authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack overflow during query processing and aborting the entire process. This vulnerability can have a signif [truncated]
CVE-2026-63736 is a server-side request forgery vulnerability in SurrealDB before 3.2.0. The vulnerability exists in the JWKS fetcher, which validates only the URL hostname string against allow-lists without checking resolved IP addresses. An attacker with the Owner role can exploit this vulnerability by pointing an access method at an allow-listed hostname resolving to private or loopback addresses, caus [truncated]
CVE-2026-63735 is a high-severity vulnerability in SurrealDB, a database management system. Versions before 3.2.0 fail to validate namespace and database scope in custom API routes. This oversight allows authenticated users to invoke endpoints in different namespaces or databases by specifying the target scope in the URL path. Consequently, attackers with valid credentials for any namespace or database ca [truncated]