CVE-2026-121416

Name of the Vulnerable Software and Affected Versions SurrealDB versions 2.0.0 through 3.3.0

Description The streaming engine fails to enforce restrictions set by the --deny-funcs flag when method-style function calls are used. This occurs because the MethodPart::evaluate() function invokes resolved functions without performing a capability check. Consequently, authenticated users with query submission privileges can bypass restrictions to execute denied functions using method syntax, such as [1,2].map() or $f.put() and $f.get(), allowing unauthorized reading and writing of file bucket data even when file::* permissions are denied.

Recommendations Update SurrealDB to version 3.3.1 or later.