GHSA-pgh9-49q4-hqcx: SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision
SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's mcp-session-id can hijack the session and execute MCP tools with the victim's roles and permissions.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
SurrealDB versions from 3.1.0 up to, but not including, 3.3.0 are affected when MCP sessions use JWT or Bearer authentication. Exploitation requires the attacker and victim to use the same access method.
What does an attacker need to hijack a session?
The attacker needs a valid low-privilege JWT or Bearer token for the same access method as the victim, plus the victim's mcp-session-id. No user interaction is required.
What is the impact after a successful hijack?
An attacker can execute MCP tools using the victim's roles and permissions. This can compromise confidentiality and integrity within the permissions granted to the victim.
What version fixes the issue?
Upgrade to SurrealDB 3.3.0 or later. The affected range is 3.1.0 before 3.3.0.