CVE-2026-63758: SurrealDB before 3.1.0 Authorization Bypass via KILL Statement

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-20 · updated 2026-07-22
Weakness: CWE-862

Description

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions of other users without ownership verification.

Affected products

surrealdb: before 3.1.0 — fixed in 3.1.0

How to fix

Upgrade to a fixed version: surrealdb 3.1.0. Check the vendor advisory for mitigations.

References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gcwr-5mrf-fvch
https://www.vulncheck.com/advisories/surrealdb-before-authorization-bypass-via-kill-statement

Get alerted when CVE-2026-63758 or the next vulnerability affects your stack