You are affected if you are using SurrealDB versions >= 2.0.0, = 2.2.0, = 2.2.0, = 2.1.0, = 2.2.0, = 2.1.0, = 3.0.0-alpha.1, = 2.2.0, = 2.1.0, = 2.0.0-beta.1, = 2.2.0, = 2.1.0, = 2.0.0-alpha.1, = 3.0.0, = 3.1.0, = 3.0.0, = 2.2.0, = 2.1.0, = 2.2.0, = 2.1.0, = 2.0.0, = 2.2.0, = 2.1.0, = 3.0.0-alpha.8, < 3.0.0-beta.3.

CARGO · AUGUST 2026 · EARLY WARNING

SurrealDB Permissions Leak: Early Warning and Mitigation Steps

Q: What should I do right now?

Upgrade all affected instances of SurrealDB to version 3.1.4 to mitigate the permissions leak. Monitor the primary sources for updates on the vulnerability and any additional patches that may be released.

Q: What versions of SurrealDB are safe to use?

The patched version is SurrealDB 3.1.4. Any version equal to or greater than 3.1.4 is considered safe.

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
Affected component: surrealdb (cargo)
Affected versions: >= 2.0.0, < 2.1.4 or >= 2.2.0, < 2.2.2 or < 2.1.5 or >= 2.2.0, < 2.2.2 or >= 2.1.0, < 2.1.5 or < 2.0.5 or >= 2.2.0, < 2.2.2 or < 2.0.5 or >= 2.1.0, < 2.1.5 or < 2.5.0 or >= 3.0.0-alpha.1, < 3.0.0-beta.3 or < 3.1.0 or < 3.1.0 or < 3.1.0 or < 1.1.0 or >= 2.2.0, < 2.2.2 or >= 2.1.0, < 2.1.5 or < 2.0.5 or < 3.1.0 or < 1.5.5 or >= 2.0.0-beta.1, < 2.0.0-beta.3 or < 3.1.0 or < 3.1.0 or < 1.1.0 or < 3.1.0 or < 3.1.0 or < 1.2.0 or < 3.1.4 or < 1.2.1 or < 2.0.4 or < 3.1.0 or < 3.1.0 or < 3.1.0 or < 3.1.5 or >= 2.2.0, < 2.2.2 or >= 2.1.0, < 2.1.5 or < 2.0.5 or < 3.1.0 or < 3.1.0 or < 3.1.0 or < 3.1.0 or < 1.5.4 or >= 2.0.0-alpha.1, < 2.0.0-alpha.6 or < 2.1.0 or >= 3.0.0, < 3.1.5 or < 3.1.5 or >= 3.1.0, < 3.1.5 or < 2.1.0 or < 1.1.1 or >= 3.0.0, < 3.1.5 or < 1.1.0 or < 2.1.0 or >= 2.2.0, < 2.2.2 or >= 2.1.0, < 2.1.5 or < 2.0.5 or >= 2.2.0, < 2.2.2 or >= 2.1.0, < 2.1.5 or < 2.0.5 or < 1.1.1 or < 3.1.0 or < 3.1.0 or >= 2.0.0, < 2.0.4 or >= 2.2.0, < 2.2.2 or >= 2.1.0, < 2.1.5 or < 2.0.5 or < 3.1.0 or < 3.1.0 or < 3.1.0 or < 3.1.0 or < 1.0.1 or < 2.6.1 or >= 3.0.0-alpha.8, < 3.0.0-beta.3
Patched version: 3.1.4

GHSA-8RW6-P7M8-63JP

SurrealDB has a permissions leak where element-level SELECT permissions are not enforced correctly for RECORD users, potentially allowing them to read elements that should be hidden.

What happened

SurrealDB is reportedly affected by a permissions leak where element-level SELECT permissions are not enforced correctly for RECORD users. This vulnerability allows RECORD users to read elements that should be hidden. The issue is under investigation and has not yet been exploited in the wild. The vulnerability affects multiple versions of SurrealDB, as detailed in the affected components section.

The permissions leak was first flagged on 2026-08-14T19:40:48+00:00. The issue has been tracked under GHSA-8RW6-P7M8-63JP. Users are advised to upgrade to SurrealDB 3.1.4 to resolve the permissions leak.

What to do about it

Identify all instances of SurrealDB in your environment and check their versions.
Upgrade all affected instances of SurrealDB to version 3.1.4 to mitigate the permissions leak.
Monitor the primary sources for updates on the vulnerability and any additional patches that may be released.
Review your SurrealDB configurations to ensure that permissions are correctly enforced.
Consider implementing additional access controls as a temporary measure until all instances are upgraded.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If surrealdb is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using SurrealDB versions >= 2.0.0, < 2.1.4 or >= 2.2.0, < 2.2.2 or < 2.1.5 or >= 2.2.0, < 2.2.2 or >= 2.1.0, < 2.1.5 or < 2.0.5 or >= 2.2.0, < 2.2.2 or < 2.0.5 or >= 2.1.0, < 2.1.5 or < 2.5.0 or >= 3.0.0-alpha.1, < 3.0.0-beta.3 or < 3.1.0 or < 3.1.0 or < 3.1.0 or < 1.1.0 or >= 2.2.0, < 2.2.2 or >= 2.1.0, < 2.1.5 or < 2.0.5 or < 3.1.0 or < 3.1.0 or < 3.1.0 or < 3.1.0 or < 1.5.5 or >= 2.0.0-beta.1, < 2.0.0-beta.3 or < 3.1.0 or < 3.1.0 or < 1.1.0 or < 3.1.0 or < 3.1.0 or < 1.2.0 or < 3.1.4 or < 1.2.1 or < 2.0.4 or < 3.1.0 or < 3.1.0 or < 3.1.0 or < 3.1.0 or < 3.1.5 or >= 2.2.0, < 2.2.2 or >= 2.1.0, < 2.1.5 or < 2.0.5 or < 3.1.0 or < 3.1.0 or < 3.1.0 or < 3.1.0 or < 1.5.4 or >= 2.0.0-alpha.1, < 2.0.0-alpha.6 or < 2.1.0 or >= 3.0.0, < 3.1.5 or < 3.1.5 or >= 3.1.0, < 3.1.5 or < 2.1.0 or < 1.1.1 or >= 3.0.0, < 3.1.5 or < 1.1.0 or < 2.1.0 or >= 2.2.0, < 2.2.2 or >= 2.1.0, < 2.1.5 or < 2.0.5 or >= 2.2.0, < 2.2.2 or >= 2.1.0, < 2.1.5 or < 2.0.5 or < 1.1.1 or < 3.1.0 or < 3.1.0 or >= 2.0.0, < 2.0.4 or >= 2.2.0, < 2.2.2 or >= 2.1.0, < 2.1.5 or < 2.0.5 or < 3.1.0 or < 3.1.0 or < 3.1.0 or < 3.1.0 or < 1.0.1 or < 2.6.1 or >= 3.0.0-alpha.8, < 3.0.0-beta.3.

What should I do right now?

Upgrade all affected instances of SurrealDB to version 3.1.4 to mitigate the permissions leak. Monitor the primary sources for updates on the vulnerability and any additional patches that may be released.

What versions of SurrealDB are safe to use?

The patched version is SurrealDB 3.1.4. Any version equal to or greater than 3.1.4 is considered safe.

Sources

[GHSA-8rw6-p7m8-63jp] SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

Join the 0Day waitlist →

← Back to all threats