PT-2026-61557 · Surrealdb · Surrealdb

CVE-2026-63741 · Published 2026-07-20 · Updated 2026-07-20

Mitre

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can create arbitrary namespaces and databases by issuing USE commands, bypassing authorization checks in the RPC use method and SurrealQL executor.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-63741

Affected Products

Surrealdb

References · 3

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-wp87-mgvq-5j93 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-63741 · Security Note
• https://vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-use-statement · Note