Attack Chain

1. An unauthenticated attacker sends an HTTP request to the /rpc sessions endpoint of a vulnerable SurrealDB instance.
2. The SurrealDB server, due to the vulnerability, responds by exposing active session UUIDs without requiring any authentication.
3. The attacker collects and enumerates the obtained session UUIDs, identifying potentially authenticated sessions.
4. The attacker crafts subsequent API requests, incorporating a stolen session UUID to impersonate an authenticated user.
5. With the impersonated session, the attacker sends unauthorized requests to read, write, or delete data within the SurrealDB instance.
6. Through persistent unauthorized data manipulation or by leveraging specific data access, the attacker achieves privilege escalation within the database.
7. The attacker maintains persistent unauthorized access and control over the SurrealDB instance's data and operations.

Impact

Successful exploitation of CVE-2026-63757 leads to complete compromise of the affected SurrealDB instance. Attackers can gain full read, write, and delete capabilities over all stored data, bypassing normal authentication and authorization mechanisms. This directly impacts data confidentiality, integrity, and availability. Furthermore, the ability to escalate privileges means an attacker could potentially gain administrative control over the database, allowing them to manipulate database schemas, user accounts, and potentially extend their access to other connected systems. Organizations using SurrealDB versions prior to 3.1.0 face a critical risk of data theft, data destruction, and unauthorized system access.

Recommendation

• Patch CVE-2026-63757 immediately by upgrading all SurrealDB instances to version 3.1.0 or later.
• Monitor webserver logs for unusual or frequent unauthenticated access attempts to the /rpc sessions endpoint, especially from external IP addresses.
• Review all SurrealDB logs for unauthorized data modification or deletion attempts following unauthenticated access to identify potential exploitation of CVE-2026-63757.