CVE-2026-102876: Surrealdb

High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days.

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant's namespace and database to read, create, and modify records across tenant boundaries.

Affected products

• Surrealdb Surrealdb: before 3.3.0 (fixed in 3.3.0)

Published 2026-09-29. Last modified 2026-10-02.