www.vulncheck.com

CVE-2026-121416: SurrealDB Deny Funcs Bypass Vulnerability Disclosed

First seen 3 Nov 2026, 16:45 UTC • •63.0

Article Content

1 / 4

Browse articles

ThreatCluster •November 3, 2026 at 17:17 UTC

•CVE-2026-121416 allows bypass of function restrictions in SurrealDB.
•Affected versions include SurrealDB 2.0.0 to 3.3.1 with a CVSS score of 7.1.
•Immediate remediation is recommended for exposed or multi-tenant deployments.

A vulnerability identified as CVE-2026-121416 affects SurrealDB versions 2.0.0 to 3.3.1, allowing authenticated users to bypass method-style function restrictions. This flaw arises from the MethodPart::evaluate function, which fails to enforce capability checks, enabling unauthorized access to sensitive functions like file bucket data manipulation. The risk is particularly high for internet-facing or multi-tenant database deployments where query access is broadly granted. Exploitation could lead to unauthorized data exposure or changes, but does not directly disrupt services. The vulnerability was published on November 3, 2026, with a CVSS score of 7.1, indicating a high severity. Remediation is advised through upgrading to the vendor-fixed release or restricting query access until a patch is applied.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-11-03

CVE-2026-121416 published

SurrealDB vulnerability disclosed, allowing bypass of deny-funcs restrictions via method-style calls.

Redpacketsecurity

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Data Breach

Vulnerability (1)

CVE-2026-121416

Weakness (2)

CWE-200 - Exposure of Sensitive Information
CWE-287 - Improper Authentication

Affected Platform (1)

SurrealDB

Relationships

CVE-2026-121416 targets SurrealDB
Data Breach targets SurrealDB
CVE-2026-121416 related to CWE-200 - Exposure of Sensitive Information
CVE-2026-121416 related to CWE-287 - Improper Authentication

Following this threat?

Track CVE-2026-121416 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What versions of SurrealDB are affected?

SurrealDB versions 2.0.0 to 3.3.1 are affected by CVE-2026-121416.

What is the risk of this vulnerability?

The vulnerability allows authenticated users to bypass restrictions and access sensitive functions, potentially leading to unauthorized data exposure.

What should organizations do to mitigate this issue?

Organizations should upgrade to the fixed release or restrict query access until a patch is applied.