Unrated severityNVD Advisory· Published Jul 20, 2026· Updated Jul 28, 2026
SurrealDB before 3.1.0 Authentication Bypass via USE statement
CVE-2026-63741
Description
SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can create arbitrary namespaces and databases by issuing USE commands, bypassing authorization checks in the RPC use method and SurrealQL executor.
Affected products
1Patches
Vulnerability mechanics
References
2- github.com/surrealdb/surrealdb/security/advisories/GHSA-wp87-mgvq-5j93mitrevendor-advisory
- www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-use-statementmitrethird-party-advisory
News mentions
0No linked articles in our index yet.