VULNERABILITY INTELLIGENCE

CVE-2026-63741

CVSS score6.5 MEDIUM
EPSS probability0.37%
CISA KEVNot currently listed
Published2026-07-20
Last modified2026-07-23
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Description

SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can create arbitrary namespaces and databases by issuing USE commands, bypassing authorization checks in the RPC use method and SurrealQL executor.

Weakness classification

  • disclosure@vulncheck.com: CWE-862

Primary references