CVE-2026-102876 — SurrealDB before 3.3.0 Cross-Tenant Access via Headers
SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers …
Published: 2026-09-29 · CVSS: 8.6 · CVSS 4.0
SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant's namespace and database to read, create, and modify records across tenant boundaries.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7