surrealdb vulnerabilities and CVEs

Known vulnerabilities affecting surrealdb, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

8 vulnerabilities tracked.

• 8.8 SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into… CVE-2026-121417 3 Nov 2026
• 8.6 SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access… CVE-2026-121419 3 Nov 2026
• 7.1 SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by… CVE-2026-121423 3 Nov 2026
• 7.1 SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because… CVE-2026-121416 3 Nov 2026
• 5.3 SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field… CVE-2026-121418 3 Nov 2026
• 5.3 SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific… CVE-2026-121421 3 Nov 2026
• 5.1 SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific… CVE-2026-121422 3 Nov 2026
• 4.8 SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver isprivateip check that… CVE-2026-121420 3 Nov 2026