Authorization Bypass in SurrealDB Affects Unauthenticated Access

CVE-2026-63741

What is CVE-2026-63741?

SurrealDB versions before 3.1.0 exhibit a security flaw that allows unauthenticated attackers to bypass authorization checks when issuing USE NS and USE DB statements. This weakness enables the creation of arbitrary namespaces and databases, which occurs due to the failure to validate permissions accurately. The vulnerability is rooted in how the RPC use method and SurrealQL executor process requests without adequate safeguards. Administrators should update to the latest version to mitigate this risk.

References