CVE-2026-63756 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition
Unauthenticated attackers can hijack authenticated sessions via a race condition in the RPC endpoint to execute operations with elevated privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-63756?
CVE-2026-63756 is a critical vulnerability in Surrealdb Surrealdb, published on 20 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated session state. Unauthenticated attackers can send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active to execute operations with hijacked user privileges.
Weakness: CWE-362
Which versions are affected by CVE-2026-63756?
It affects 1 product.
Products include Surrealdb Surrealdb.
How do I fix CVE-2026-63756?
No fix has been published for CVE-2026-63756 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-63756 being exploited?
There is no known exploitation of CVE-2026-63756 in the wild and no public exploit code.
Other vulnerabilities in Surrealdb Surrealdb
- CVE-2025-71392 SurrealDB before 2.2.2 SurrealQL Injection via export
- CVE-2026-63747 SurrealDB before 3.1.0 Denial of Service via malformed RPC use
- CVE-2026-63757 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions
- CVE-2026-63760 SurrealDB before 3.1.0 Denial of Service via JSON Parser
- CVE-2023-54366 SurrealDB before 1.0.1 Insecure Default Table Permissions
Sources
Also known as GHSA-fmh9-9m2w-q5p4.