Read the docs
TI-2026-45350 Aliases CVE-2026-63763GHSA-5w8c-cvwv-f5px

SurrealDB before 2.5.0 Privilege Escalation via Future Fields

Priority LOW 35CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users (e.g., those with the database editor role) can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the invoking/querying user rather than their creator, an attacker can plant malicious logic that executes with a higher-privileged user's permissions when that user reads or writes the affected record. This can lead to full privilege escalation, including creation of a root owner and server takeover.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00497 42nd percentileScored 2026-11-07
Fix Fixed surrealdb (surrealdb): 2.5.0, 3.0.0-beta.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
surrealdbsurrealdbbefore 2.5.02.5.0Patch availableCNA
surrealdbsurrealdb3.0.0-alpha.1 to before 3.0.0-beta.33.0.0-beta.3Patch availableCNA
  • surrealdb Vendorsurrealdb Affected before 2.5.0 Fixed in 2.5.0 Patch available CNA
  • surrealdb Vendorsurrealdb Affected 3.0.0-alpha.1 to before 3.0.0-beta.3 Fixed in 3.0.0-beta.3 Patch available CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*before 2.5.0Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha1:*:*:*:*:*:*3.0.0 alpha1Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha10:*:*:*:*:*:*3.0.0 alpha10Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha11:*:*:*:*:*:*3.0.0 alpha11Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha12:*:*:*:*:*:*3.0.0 alpha12Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha13:*:*:*:*:*:*3.0.0 alpha13Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha14:*:*:*:*:*:*3.0.0 alpha14Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha16:*:*:*:*:*:*3.0.0 alpha16Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha17:*:*:*:*:*:*3.0.0 alpha17Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha18:*:*:*:*:*:*3.0.0 alpha18Vulnerablesurrealdb
  • cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:* Versions before 2.5.0 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha1:*:*:*:*:*:* Versions 3.0.0 alpha1 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha10:*:*:*:*:*:* Versions 3.0.0 alpha10 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha11:*:*:*:*:*:* Versions 3.0.0 alpha11 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha12:*:*:*:*:*:* Versions 3.0.0 alpha12 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha13:*:*:*:*:*:* Versions 3.0.0 alpha13 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha14:*:*:*:*:*:* Versions 3.0.0 alpha14 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha16:*:*:*:*:*:* Versions 3.0.0 alpha16 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha17:*:*:*:*:*:* Versions 3.0.0 alpha17 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha18:*:*:*:*:*:* Versions 3.0.0 alpha18 Vulnerable ·surrealdb
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha2:*:*:*:*:*:*3.0.0 alpha2Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha3:*:*:*:*:*:*3.0.0 alpha3Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha4:*:*:*:*:*:*3.0.0 alpha4Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha5:*:*:*:*:*:*3.0.0 alpha5Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha6:*:*:*:*:*:*3.0.0 alpha6Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha7:*:*:*:*:*:*3.0.0 alpha7Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha8:*:*:*:*:*:*3.0.0 alpha8Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha9:*:*:*:*:*:*3.0.0 alpha9Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:3.0.0:beta1:*:*:*:*:*:*3.0.0 beta1Vulnerablesurrealdb
cpe:2.3:a:surrealdb:surrealdb:3.0.0:beta2:*:*:*:*:*:*3.0.0 beta2Vulnerablesurrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha2:*:*:*:*:*:* Versions 3.0.0 alpha2 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha3:*:*:*:*:*:* Versions 3.0.0 alpha3 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha4:*:*:*:*:*:* Versions 3.0.0 alpha4 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha5:*:*:*:*:*:* Versions 3.0.0 alpha5 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha6:*:*:*:*:*:* Versions 3.0.0 alpha6 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha7:*:*:*:*:*:* Versions 3.0.0 alpha7 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha8:*:*:*:*:*:* Versions 3.0.0 alpha8 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha9:*:*:*:*:*:* Versions 3.0.0 alpha9 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:beta1:*:*:*:*:*:* Versions 3.0.0 beta1 Vulnerable ·surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:3.0.0:beta2:*:*:*:*:*:* Versions 3.0.0 beta2 Vulnerable ·surrealdb

Remediation

  • Fix · CNA surrealdb (surrealdb) Fixed in 2.5.0
  • Fix · CNA surrealdb (surrealdb) Fixed in 3.0.0-beta.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    surrealdb 3.0.0-beta.3

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-45349 SurrealDB before v2.6.1 Denial of Service via scriptingPriority LOW 27
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63763
  2. 2026-10-03 Alias added: GHSA-5w8c-cvwv-f5px

References

Advisory 1

  • TI-2026-45344 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions CVSS 4.0HIGH 8.7
  • TI-2024-38452 SurrealDB before 1.1.0 Denial of Service via HTTP Headers CVSS 4.0HIGH 8.7
  • TI-2026-45347 SurrealDB before 3.1.0 Denial of Service via JSON Parser CVSS 4.0HIGH 8.7
  • TI-2026-45334 SurrealDB before 3.1.0 Denial of Service via malformed RPC use CVSS 4.0HIGH 8.7
  • TI-2025-43508 SurrealDB before 2.2.2 SurrealQL Injection via export CVSS 4.0CRITICAL 9.4
  • TI-2026-45343 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition CVSS 4.0CRITICAL 9.2
See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences