CVE-2026-63741 — MEDIUM (6.5)

Q: How severe is CVE-2026-63741?

CVE-2026-63741 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-63741?

Check the references section above for vendor advisories and patch information. Affected products include: Surrealdb Surrealdb.

Vulnerability Description

SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can create arbitrary namespaces and databases by issuing USE commands, bypassing authorization checks in the RPC use method and SurrealQL executor.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Surrealdb	Surrealdb	< 3.1.0

Related Weaknesses (CWE)

CWE-862

References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-wp87-mgvq-5j93MitigationVendor Advisory
https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-Third Party Advisory

FAQ

What is CVE-2026-63741?

CVE-2026-63741 is a vulnerability with a CVSS score of 6.5 (MEDIUM). SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can create arbitrary namespaces...

How severe is CVE-2026-63741?

CVE-2026-63741 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-63741?

Check the references section above for vendor advisories and patch information. Affected products include: Surrealdb Surrealdb.