NPM · SEPTEMBER 2026 · EARLY WARNING

SurrealDB Vulnerability: Namespace/Database Scope Bypass

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
Affected component: surrealdb (npm)
Patched version: Not yet available

GHSA-848M-R628-VRXW

An early warning has been issued for a vulnerability in SurrealDB that could allow an authenticated user to invoke a custom API belonging to a different namespace/database.

What happened

An early warning has been issued for a vulnerability in SurrealDB. This vulnerability could allow an authenticated user scoped to one namespace/database to invoke a custom API belonging to a different namespace/database, effectively reaching another tenant's endpoint. This is because the namespace and database from the URL were applied to the caller's session without proper scope validation.

The vulnerability is reportedly tracked under GHSA-848M-R628-VRXW. It is under investigation and has not been exploited in the wild as of the latest reports. The recommended action to mitigate this issue is to upgrade to SurrealDB version 3.2.0 or later.

What to do about it

Upgrade to SurrealDB version 3.2.0 or later to mitigate the issue.
Review your application's use of custom APIs and ensure proper scope validation is in place.
Monitor the primary sources for updates on this vulnerability.
Consider implementing additional access controls to limit the impact of this vulnerability until the upgrade is completed.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If surrealdb is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If you are using SurrealDB and have not upgraded to version 3.2.0 or later, you may be affected by this vulnerability.

What should I do right now?

Upgrade to SurrealDB version 3.2.0 or later as soon as possible to mitigate the issue.

Has this been exploited in the wild?

There are no reports of this vulnerability being exploited in the wild as of the latest information.

Sources

Join the 0Day waitlist →

← Back to all threats