SurrealDB: Security capability bypass in streaming engine (CVE-2026-121416)

A security vulnerability exists in the SurrealDB streaming engine where method-style function calls bypass the configured '--deny-funcs' capability restrictions. The vulnerability stems from the 'MethodPart::evaluate' function, which invokes resolved functions without performing necessary capability checks. This allows an authenticated user to perform restricted actions, such as arbitrary file system access using 'file::*' functions, by wrapping them in method-style syntax (e.g., '.map()').

Impact

Successful exploitation allows an authenticated user with query submission privileges to bypass defined system restrictions. This can result in unauthorized reading or writing of data within configured file buckets, effectively neutralizing security controls intended to limit function execution.

Recommendation

• Update all SurrealDB instances to version 3.3.1 or later to apply the capability check fix.
• Review and audit existing query logs for usage of method-style syntax that attempts to interact with restricted functions (e.g., 'file::' namespaces).
• Restrict query submission privileges to trusted users until the patch is applied.