SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system… (CVE-2026-109334)

SurrealDB prior to version 3.3.0 fails to validate that the namespace or database specified by the caller matches the permission level of the authenticated system user. This improper authorization check enables an authenticated attacker to set Surreal-NS/Surreal-DB headers on /sql endpoints or invoke the RPC use method to perform unauthorized read, create, modify, and delete operations on data belonging to other tenants, provided the table permissions allow such actions. The vulnerability is tracked as CVE-2026-109334 and has a CVSS 3.1 base score of 8.1, indicating high severity.

An authenticated attacker can bypass tenant isolation controls and access or modify data in other tenants' namespaces or databases where table permissions permit. This compromises confidentiality and integrity of data across tenants but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to the minimum necessary and monitor for unauthorized cross-tenant access attempts.