Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: surrealdb 3.2.0 Clear all filters
TI-2026-45323 CVE-2026-63736 · GHSA-qrjc-jcj4-56p7

SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution

Priority LOW 23

SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string against allow-lists without checking resolved IP addresses.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00314 Published 2026-07-20 Fixed in 3.2.0 CWE-918
TI-2026-45322 CVE-2026-63735 · GHSA-848m-r628-vrxw

SurrealDB before 3.2.0 Authentication Bypass via Custom API

Priority LOW 37

SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in different namespaces/databases.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00367 Published 2026-07-20 Fixed in 3.2.0 CWE-639
TI-2026-45321 CVE-2026-63734 · GHSA-vm8f-3v3v-fhw4

SurrealDB before 3.2.0 Denial of Service via malformed SurrealML import

Priority LOW 31

SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/impo…

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00472 Published 2026-07-20 Fixed in 3.2.0 CWE-20
TI-2026-45320 CVE-2026-63733 · GHSA-66r2-5gwj-gxm2

SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clause

Priority LOW 24

SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00287 Published 2026-07-20 Fixed in 3.2.0 CWE-863