Skip to content
High-Risk Authentication Flaw in SurrealDB Exposed

High-Risk Authentication Flaw in SurrealDB Exposed

First seen 3 Nov 2026, 23:48 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 3, 2026 at 23:49 UTC
  • •CVE-2026-121419 affects SurrealDB versions 3.1.0 to 3.2.9.
  • •Attackers can hijack sessions using low-privilege tokens and victim session IDs.
  • •Immediate upgrade to version 3.3.0 is recommended to mitigate risks.

SurrealDB versions 3.1.0 to 3.2.9 have an improper authentication vulnerability (CVE-2026-121419) that allows attackers to hijack sessions using a valid low-privilege token and a victim's mcp-session-id. This flaw enables unauthorized execution of MCP tools with the victim's roles and permissions, posing a high risk to exposed deployments. Attackers need an existing account or token, making credential theft or account compromise a realistic exploitation route. The vulnerability was disclosed on November 3, 2026, and is rated with a CVSS score of 8.6, indicating high severity. Organizations are advised to upgrade to version 3.3.0 or later and to limit network access to vulnerable deployments until a patch is applied.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 5h ago How this analysis works

Timeline

2026-11-03
CVE-2026-121419 published
SurrealDB disclosed an improper authentication vulnerability affecting versions 3.1.0 to 3.2.9, rated CVSS 8.6.
Redpacketsecurity

More articles in this cluster (2)

Following this threat?

Track CVE-2026-121419 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 4

Common questions

What versions of SurrealDB are affected?
SurrealDB versions from 3.1.0 to 3.2.9 are affected by CVE-2026-121419.
What is the risk of this vulnerability?
The vulnerability allows attackers to hijack sessions and execute commands with victim permissions, posing a high risk.
What should organizations do to protect themselves?
Organizations should upgrade to SurrealDB version 3.3.0 or later and limit network access to vulnerable deployments.