CVE-2026-121416: SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations
SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax, e.g. [1,2].map() or $f.put()/$f.get() to write and read file bucket data despite file:: denials.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SurrealDBto a version that resolves this vulnerability.Fixed in 3.3.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can submit SurrealDB queries can exploit it. The issue affects deployments that rely on --deny-funcs restrictions to block particular functions.
What configuration is required for exposure?
The affected configuration uses --deny-funcs to deny functions, including file::* functions. Those restrictions can be bypassed when the function is invoked using method-style syntax in the streaming engine.
What can an attacker do through the bypass?
An attacker can invoke functions that were intended to be denied. For example, they may use $f.put() and $f.get() to write and read file bucket data despite file::* denials.
How can I identify potentially affected instances?
Instances running SurrealDB 2.0.0 through versions before 3.3.1 are potentially affected if authenticated users can submit queries and the deployment uses --deny-funcs. Review whether denied functions can be reached through method-style calls such as [1,2].map() or $f.put().