{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/surrealdb--3.3.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-121416"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SurrealDB (\u003c 3.3.1)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","privilege-escalation","database"],"_cs_type":"advisory","_cs_vendors":["SurrealDB"],"content_html":"\u003cp\u003eA security vulnerability exists in the SurrealDB streaming engine where method-style function calls bypass the configured '--deny-funcs' capability restrictions. The vulnerability stems from the 'MethodPart::evaluate' function, which invokes resolved functions without performing necessary capability checks. This allows an authenticated user to perform restricted actions, such as arbitrary file system access using 'file::*' functions, by wrapping them in method-style syntax (e.g., '.map()').\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user with query submission privileges to bypass defined system restrictions. This can result in unauthorized reading or writing of data within configured file buckets, effectively neutralizing security controls intended to limit function execution.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all SurrealDB instances to version 3.3.1 or later to apply the capability check fix.\u003c/li\u003e\n\u003cli\u003eReview and audit existing query logs for usage of method-style syntax that attempts to interact with restricted functions (e.g., 'file::' namespaces).\u003c/li\u003e\n\u003cli\u003eRestrict query submission privileges to trusted users until the patch is applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T15:59:37Z","date_published":"2026-11-03T15:59:37Z","id":"https://feed.craftedsignal.io/briefs/2026-11-surrealdb-deny-funcs-bypass/","summary":"SurrealDB versions 2.0.0 through 3.3.0 fail to enforce --deny-funcs restrictions on method-style function calls, allowing authenticated users to execute forbidden functions and bypass file system access controls.","title":"SurrealDB: Security capability bypass in streaming engine (CVE-2026-121416)","url":"https://feed.craftedsignal.io/briefs/2026-11-surrealdb-deny-funcs-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - SurrealDB (\u003c 3.3.1)","version":"https://jsonfeed.org/version/1.1"}