CVE-2026-109334

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.3.0

Description An issue exists where the system fails to verify if the caller-selected namespace or database matches the authentication level of a namespace- or database-level system user, enabling cross-tenant access. An authenticated attacker can manipulate the Surreal-NS and Surreal-DB headers on the '/sql' endpoint or utilize the use() RPC method to perform unauthorized operations, including reading, creating, modifying, and deleting rows, as well as reading DEFINE PARAM values in another tenant, provided that table PERMISSIONS allow such actions.

Recommendations Update SurrealDB to version 3.3.0 or later.