Description
SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated session state. Unauthenticated attackers can send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active to execute operations with hijacked user privileges.
Published: 2026-07-20
Score: 9.2 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A race condition in the HTTP /rpc endpoint allows unauthenticated attackers to inherit authenticated session state, enabling them to perform privileged operations. The vulnerability is a time‑of‑check/time‑of‑use flaw (CWE‑362).

Affected Systems

SurrealDB versions earlier than 3.1.0 from the vendor surrealdb are affected. No specific sub‑versions are listed, so all releases before 3.1.0 are considered vulnerable.

Risk and Exploitability

The CVSS score of 9.2 signifies critical severity, although the EPSS score is < 1%, indicating a very low but nonzero likelihood of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly reported exploits as of the last update. Attackers can exploit the flaw by sending concurrent requests to the /rpc endpoint while an authenticated session exists, potentially hijacking privileged actions.

Generated by OpenCVE AI on July 30, 2026 at 19:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade SurrealDB to version 3.1.0 or later.
  • Disable or restrict unauthenticated access to the /rpc HTTP endpoint.
  • Validate and isolate internal session handling to prevent session takeover.

Generated by OpenCVE AI on July 30, 2026 at 19:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Surrealdb
Surrealdb surrealdb
Vendors & Products Surrealdb
Surrealdb surrealdb

Tue, 21 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 20 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Description SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated session state. Unauthenticated attackers can send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active to execute operations with hijacked user privileges.
Title SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition
Weaknesses CWE-362
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Surrealdb Surrealdb
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-28T01:05:47.907Z

Reserved: 2026-07-18T12:30:08.354Z

Link: CVE-2026-63756

cve-icon Vulnrichment

Updated: 2026-07-21T15:12:27.729Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T19:45:06Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')