SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries (CVE-2026-63758)

The KILL statement in SurrealDB (core/src/expr/statements/kill.rs) is intended to terminate LIVE SELECT subscriptions that provide real-time updates. While it verifies that the user has database-level access, it does not verify ownership of the live query before deletion. After passing the valid_for_db() check, the statement deletes the live query entry without comparing the requesting user's identity to the owner, enabling any authenticated user with database-level access to terminate any live query in the same database. This affects availability by silently stopping real-time subscriptions and breaks multi-tenant isolation guarantees. The vulnerability was discovered and patched during a code audit and penetration test by cure53. The fix, introduced in SurrealDB 3.1.0, adds an ownership verification step before allowing deletion of live queries.

An authenticated user with database-level access can terminate any other user's live query subscriptions within the same database by issuing a KILL statement with the target live query's UUID. This causes silent disruption of real-time data subscriptions, impacting availability and violating multi-tenant isolation. The attack requires knowledge of the live query UUID, which may be exposed through logs or shared monitoring tools. The vulnerability affects all users regardless of privilege level, allowing low-privilege users to disrupt higher-privilege users' live queries.

A patch is available in SurrealDB version 3.1.0 and later that introduces an ownership verification check in the KILL statement implementation. Users should upgrade to version 3.1.0 or later to remediate this issue. For users unable to upgrade immediately, it is recommended to treat live query UUIDs as sensitive and avoid exposing them through logs or shared interfaces. Additionally, where multi-tenant isolation is critical, separate databases per tenant should be used instead of relying solely on record-level access controls. Monitoring for unexpected live query terminations and implementing reconnection and re-subscription mechanisms in application logic can also help mitigate impact.