CVE-2026-121418: SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner
SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW KNN queries against restricted fields to learn which records contain guessed values or nearest vectors.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs record-user access to a vulnerable SurrealDB instance. The issue affects environments where those users can query fields that have restrictive SELECT permissions and where relevant indexes are used by the streaming planner.
What information can an attacker obtain?
The attacker can infer whether records contain guessed restricted field values through full-text MATCHES or compound B-tree queries. They can also infer nearest vectors from restricted fields using HNSW KNN queries; the issue is described as information disclosure rather than modification or availability impact.
Which versions are affected?
SurrealDB versions from 3.1.0 up to, but not including, 3.3.0 are affected. Upgrading to 3.3.0 or later removes the affected version range.