Cross-Tenant Access Vulnerability in SurrealDB by SurrealDB

CVE-2026-109334

What is CVE-2026-109334?

SurrealDB prior to version 3.3.0 has a vulnerability that allows authenticated users to bypass namespace and database restrictions, enabling unauthorized access to data across different tenants. This can be exploited through the manipulation of Surreal-NS/Surreal-DB headers during SQL requests or RPC methods, permitting an attacker to read, create, modify, or delete data in another tenant environment. The flaw originates from insufficient checks on user authentication levels against specified namespaces or database permissions.

References