CVE-2026-102876: SurrealDB before 3.3.0 Cross-Tenant Access via Headers
SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where checkauth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant's namespace and database to read, create, and modify records across tenant boundaries.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require valid credentials?
Yes. An attacker needs to authenticate as a user in one tenant, then supply different Surreal-NS and Surreal-DB headers to select another tenant's namespace and database.
Which deployments should be treated as exposed?
SurrealDB HTTP deployments running a version before 3.3.0 where users can authenticate and where multiple tenants, namespaces, or databases are accessible through the service should be treated as exposed.
What version resolves the issue?
The issue affects versions before 3.3.0, so upgrading to 3.3.0 or later removes the affected version range.