Read the docs
TI-2024-38446 Aliases CVE-2024-58362

SurrealDB before 1.5.5 Query Injection via RPC API

Priority MEDIUM 41CWE-75Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted users, an unauthenticated attacker can encode a binary object containing a subquery using the bincode serialization format and supply it in place of credentials. The subquery is then executed within the database owner's SIGNIN/SIGNUP query under a system user session with the editor role, allowing the attacker to select, create, update, and delete non-IAM resources (though not view the query results directly, and not affect IAM resources, which require the owner role).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00636 50th percentileScored 2026-11-07
Fix Fixed surrealdb (surrealdb): 1.5.5, 2.0.0-beta.3, 1.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
surrealdbsurrealdbbefore 1.5.5; 2.0.0-beta.1 to before 2.0.0-beta.31.5.5, 2.0.0-beta.3Patch availableCNA
surrealdbsurrealdbbefore 1.5.21.5.2Patch availableCNA
  • surrealdb Vendorsurrealdb Affected before 1.5.5; 2.0.0-beta.1 to before 2.0.0-beta.3 Fixed in 1.5.5, 2.0.0-beta.3 Patch available CNA
  • surrealdb Vendorsurrealdb Affected before 1.5.2 Fixed in 1.5.2 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*before 1.5.5Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:2.0.0:beta1:*:*:*:*:*:*2.0.0 beta1Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:2.0.0:beta2:*:*:*:*:*:*2.0.0 beta2Vulnerablesurrealdb
  • cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:* Versions before 1.5.5 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:2.0.0:beta1:*:*:*:*:*:* Versions 2.0.0 beta1 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:2.0.0:beta2:*:*:*:*:*:* Versions 2.0.0 beta2 Vulnerable ·surrealdb

Remediation

  • Fix · CNA surrealdb (surrealdb) Fixed in 1.5.5, 2.0.0-beta.3
  • Fix · CNA surrealdb (surrealdb) Fixed in 1.5.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-58362
  2. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2026-45344 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions CVSS 4.0HIGH 8.7
  • TI-2024-38452 SurrealDB before 1.1.0 Denial of Service via HTTP Headers CVSS 4.0HIGH 8.7
  • TI-2026-45347 SurrealDB before 3.1.0 Denial of Service via JSON Parser CVSS 4.0HIGH 8.7
  • TI-2026-45334 SurrealDB before 3.1.0 Denial of Service via malformed RPC use CVSS 4.0HIGH 8.7
  • TI-2025-43508 SurrealDB before 2.2.2 SurrealQL Injection via export CVSS 4.0CRITICAL 9.4
  • TI-2026-45343 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition CVSS 4.0CRITICAL 9.2
See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences