CVE-2026-121416

SurrealDB versions 2.0.0 before 3.3.1 are vulnerable to a capability bypass in the streaming engine. The root cause is that MethodPart::evaluate invokes resolved functions without performing a capability check, failing to enforce --deny-funcs restrictions on method-style function calls. Consequen...

CVE-2026-121416 SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations

SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax...