CVE-2026-102876— SurrealDB before 3.3.0 Cross-Tenant Access via Headers
Quick assessment
Affected
surrealdb surrealdb
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102876
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SurrealDB before 3.3.0 Cross-Tenant Access via Headers
Source: CVE Program / CVE List V5
Vulnerability Description
SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant's namespace and database to read, create, and modify records across tenant boundaries.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-102876
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102876
请登录查看更多情报信息。
Other References for CVE-2026-102876 (5)
-
https://github.com/surrealdb/surrealdb/blob/v3.2.4/surrealdb/server/src/ntw/auth.rs technical-description
IV. Related Vulnerabilities
Same product: surrealdb
-
CVE-2026-63762
SurrealDB before v2.6.1 Denial of Service via scripting -
CVE-2026-63763
SurrealDB before 2.5.0 Privilege Escalation via Future Field -
CVE-2026-63761
SurrealDB before 3.1.0 Algorithm Downgrade via ES512 -
CVE-2026-63760
SurrealDB before 3.1.0 Denial of Service via JSON Parser -
CVE-2026-63759
SurrealDB before 3.1.0 Denial of Service nested type annotat
Same vendor: surrealdb
-
CVE-2026-63762
SurrealDB before v2.6.1 Denial of Service via scripting -
CVE-2026-63763
SurrealDB before 2.5.0 Privilege Escalation via Future Field -
CVE-2026-63761
SurrealDB before 3.1.0 Algorithm Downgrade via ES512 -
CVE-2026-63760
SurrealDB before 3.1.0 Denial of Service via JSON Parser -
CVE-2026-63759
SurrealDB before 3.1.0 Denial of Service nested type annotat
Same weakness: CWE-639
-
CVE-2026-101112
Joomla Extension - balbooa.com - Unauthorized Deletion of At -
CVE-2026-90907
Joomla! Core - [20260902] - Core - Unauthorized user account -
CVE-2026-102261
owen2345 Camaleon CMS Media Crop media_controller.rb crop au -
CVE-2026-97685
LimeSurvey Community Edition 7.3.0 - Cross-survey object aut -
CVE-2026-102373
GestSup before 3.2.62 Private Ticket Comment Disclosure via
V. Comments for CVE-2026-102876
No comments yet