SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking… (CVE-2026-109343)

CVE-2026-109343 describes a vulnerability in SurrealDB before version 3.3.0 where the SurrealQL USE statement does not verify that the caller's authenticated level authorizes switching to the requested namespace or database. As a result, authenticated users with namespace, database, or record-level access can switch to other tenants and perform unauthorized data operations on tables where permissions permit, including full permissions. This represents a cross-tenant access control bypass.

The vulnerability allows authenticated users to bypass tenant isolation controls and access or modify data belonging to other tenants. This can lead to unauthorized disclosure, modification, or deletion of sensitive data across tenants. The CVSS score of 8.1 indicates high severity with network attack vector, low attack complexity, and no user interaction required. Confidentiality and integrity impacts are high, while availability is not affected.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users only and monitor for suspicious activity related to SurrealQL USE statement misuse.