CVE-2026-109343: SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement

Q: Does exploitation require an authenticated account?

Yes. The issue is exploitable by authenticated namespace, database, or record users; the provided information does not indicate unauthenticated exploitation.

Q: Which accounts should be considered capable of crossing tenant boundaries?

Any authenticated user at the namespace, database, or record level should be considered in scope, because these users can use a SurrealQL USE statement to switch to another namespace or database without an authorization-level check.

Q: What determines whether an attacker can access or modify data after switching tenants?

The target tables' PERMISSIONS settings determine the operations available. Tables allowing broad access, such as PERMISSIONS FULL, may permit reading, creating, updating, or deleting rows.

Q: What version should be deployed to remediate this issue?

Deploy SurrealDB 3.3.0 or later. Versions before 3.3.0 are affected.

Published Oct 12, 2026

Updated

SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch to another tenant and read, create, update, or delete rows in tables whose PERMISSIONS allow it, such as PERMISSIONS FULL.

Affected Software

1 affected component

SurrealDB SurrealDB<3.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SurrealDB to a version that resolves this vulnerability.
Fixed in 3.3.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require an authenticated account?

Yes. The issue is exploitable by authenticated namespace, database, or record users; the provided information does not indicate unauthenticated exploitation.

Which accounts should be considered capable of crossing tenant boundaries?

Any authenticated user at the namespace, database, or record level should be considered in scope, because these users can use a SurrealQL USE statement to switch to another namespace or database without an authorization-level check.

What determines whether an attacker can access or modify data after switching tenants?

The target tables' PERMISSIONS settings determine the operations available. Tables allowing broad access, such as PERMISSIONS FULL, may permit reading, creating, updating, or deleting rows.

What version should be deployed to remediate this issue?

Deploy SurrealDB 3.3.0 or later. Versions before 3.3.0 are affected.

CVE-2026-109343: SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement

Affected Software

Remediation

Event History

Frequently Asked Questions

Does exploitation require an authenticated account?

Which accounts should be considered capable of crossing tenant boundaries?

What determines whether an attacker can access or modify data after switching tenants?

What version should be deployed to remediate this issue?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require an authenticated account?

Which accounts should be considered capable of crossing tenant boundaries?

What determines whether an attacker can access or modify data after switching tenants?

What version should be deployed to remediate this issue?