CVE-2024-58362 SurrealDB before 1.5.5 Query Injection via RPC API
Unauthenticated attackers can inject subqueries via RPC API to execute code and modify non-IAM resources if SIGNIN/SIGNUP queries are defined.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-58362?
CVE-2024-58362 is a high-severity code injection vulnerability in Surrealdb Surrealdb, published on 18 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted users, an unauthenticated attacker can encode a binary object containing a subquery using the bincode serialization format and supply it in place of credentials. The subquery is then executed within the database owner's SIGNIN/SIGNUP query under a system user session with the editor role, allowing the attacker to select, create, update, and delete non-IAM resources (though not view the query results directly, and not affect IAM resources, which require the owner role).
Weakness: CWE-75
Which versions are affected by CVE-2024-58362?
6 open source packages ship an affected version, including surrealdb and surrealdb-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
surrealdb crates.io | All versions | 1.5.5 |
surrealdb crates.io | All versions | 1.5.5 |
surrealdb crates.io | From 2.0.0-beta.1 | 2.0.0-beta.3 |
surrealdb crates.io | From 2.0.0-beta.1 | 2.0.0-beta.3 |
surrealdb-core crates.io | All versions | 1.5.2 |
surrealdb-core crates.io | All versions | 1.5.2 |
Products include Surrealdb Surrealdb.
How do I fix CVE-2024-58362?
Upgrade surrealdb to a fixed version for your release line: 1.5.5 or 2.0.0-beta.3.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-58362 being exploited?
There is no known exploitation of CVE-2024-58362 in the wild and no public exploit code.
Other vulnerabilities in Surrealdb Surrealdb
- CVE-2025-71392 SurrealDB before 2.2.2 SurrealQL Injection via export
- CVE-2026-63756 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition
- CVE-2026-63747 SurrealDB before 3.1.0 Denial of Service via malformed RPC use
- CVE-2026-63757 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions
- CVE-2026-63760 SurrealDB before 3.1.0 Denial of Service via JSON Parser
Sources
Also known as GHSA-64f8-pjgr-9wmr.