Description
SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated session state. Unauthenticated attackers can send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active to execute operations with hijacked user privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| surrealdb | surrealdb | < 3.1.0 | 3.1.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | surrealdb | < 3.1.0 | 3.1.0 | GHSA-4vgr-h27g-cf9p |
References
- GitHub Security Advisory (GHSA-4vgr-h27g-cf9p) vendor-advisory
- VulnCheck Advisory: SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition third-party-advisory