surrealdb vulnerabilities

Newest CVEs

• CVE-2026-121423

  SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization

  surrealdb · surrealdb

  High7.1
• CVE-2026-121422

  SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass

  surrealdb · surrealdb

  Medium5.1
• CVE-2026-121421

  SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass

  surrealdb · surrealdb

  Medium5.3
• CVE-2026-121420

  SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses

  surrealdb · surrealdb

  Medium4.8
• CVE-2026-121419

  SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision

  surrealdb · surrealdb

  High8.6
• CVE-2026-121418

  SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner

  surrealdb · surrealdb

  Medium5.3
• CVE-2026-121417

  SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends

  surrealdb · surrealdb

  High8.8
• CVE-2026-121416

  SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations

  surrealdb · surrealdb

  High7.1
• CVE-2026-109343

  SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement

  surrealdb · surrealdb

  High8.6
• CVE-2026-109342

  SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method

  surrealdb · surrealdb

  Medium5.3