Multiple High Severity Vulnerabilities Discovered in SurrealDB

• •Three high severity vulnerabilities in SurrealDB were disclosed on July 18, 2026.
• •CVE-2024-58362 allows unauthenticated access to execute subqueries via the RPC API.
• •CVE-2024-58366 and CVE-2024-58368 can lead to memory access issues and server crashes.

Three critical vulnerabilities (CVE-2024-58362, CVE-2024-58366, CVE-2024-58368) were published on July 18, 2026, affecting various versions of SurrealDB. CVE-2024-58362 allows unauthenticated attackers to execute subqueries through the RPC API during SIGNIN/SIGNUP operations. CVE-2024-58366 presents a format string vulnerability that can lead to arbitrary memory access and code execution for users with scripting privileges. CVE-2024-58368 enables attackers to crash the server by sending malformed HTTP requests. All three vulnerabilities have a high CVSS score, with CVE-2024-58362 rated at 8.8, CVE-2024-58366 at 8.5, and CVE-2024-58368 at 7.5. Active exploitation of these vulnerabilities has not been confirmed, but the potential for significant impact exists. Organizations using affected SurrealDB versions are advised to check for indicators of compromise (IOCs).