SurrealDB (3.1.0 Up To, but Not Including, 3.3.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/surrealdb-3.1.0-up-to-but-not-including-3.3.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 15:59:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSurrealDB: Improper MCP authentication vulnerability (CVE-2026-121419)https://feed.craftedsignal.io/briefs/2026-11-surrealdb-auth-bypass/Tue, 03 Nov 2026 15:59:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-surrealdb-auth-bypass/SurrealDB versions 3.1.0 before 3.3.0 contain an improper authentication vulnerability in the MCP BoundSubject fingerprint.<p>SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's mcp-session-id can hijack the session and execute MCP tools with the victim's roles and permissions.</p> highadvisory