CVE-2026-63741 SurrealDB before 3.1.0 Authentication Bypass via USE statement

SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can create arbitrary namespaces and databases by issuing USE commands, bypassing authorization checks in the RPC use method and...

EUVD-2026-45912

SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can create arbitrary namespaces and databases by issuing USE commands, bypassing authorization checks in the RPC use method and...

CVE-2026-63741

SurrealDB vulnerable component: PRE-3.1.0 handling of DEFINE NAMESPACE/DEFINE DATABASE during USE NS/USE DB. Root cause: missing validation of permissions in the DEFINE commands allows unauthenticated actors to create arbitrary namespaces and databases, bypassing authorization checks in the RPC u...