SurrealDB (< 3.3.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/surrealdb--3.3.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 15:59:37 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSurrealDB: Security capability bypass in streaming engine (CVE-2026-121416)https://feed.craftedsignal.io/briefs/2026-11-surrealdb-deny-funcs-bypass/Tue, 03 Nov 2026 15:59:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-surrealdb-deny-funcs-bypass/SurrealDB versions 2.0.0 through 3.3.0 fail to enforce --deny-funcs restrictions on method-style function calls, allowing authenticated users to execute forbidden functions and bypass file system access controls.A security vulnerability exists in the SurrealDB streaming engine where method-style function calls bypass the configured '--deny-funcs' capability restrictions. The vulnerability stems from the 'MethodPart::evaluate' function, which invokes resolved functions without performing necessary capability checks. This allows an authenticated user to perform restricted actions, such as arbitrary file system access using 'file::*' functions, by wrapping them in method-style syntax (e.g., '.map()').

Impact

Successful exploitation allows an authenticated user with query submission privileges to bypass defined system restrictions. This can result in unauthorized reading or writing of data within configured file buckets, effectively neutralizing security controls intended to limit function execution.

Recommendation

  • Update all SurrealDB instances to version 3.3.1 or later to apply the capability check fix.
  • Review and audit existing query logs for usage of method-style syntax that attempts to interact with restricted functions (e.g., 'file::' namespaces).
  • Restrict query submission privileges to trusted users until the patch is applied.
]]>highadvisoryvulnerabilityprivilege-escalationdatabase