CVE-2026-102876
SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant's namespace and database to read, create, and modify records across tenant boundaries.
- Published Sep 29, 2026
- CVSS 8.6 high
- 0.3% chance of exploitation in the next 30 days (EPSS)
- A fix is available