Surrealdb: Duplicate Advisory: Untrusted Query Object Evaluation in RPC API (CVE-2024-58362)
Description
SurrealDB versions prior to 1.5.5 and 2.0.0-beta versions before 2.0.0-beta.3 have a vulnerability in the RPC API signin and signup operations. The API accepts arbitrary objects without proper recursive validation, allowing unauthenticated attackers to supply a binary object containing a subquery. This subquery executes with editor role privileges, enabling attackers to select, create, update, and delete non-IAM resources. However, attackers cannot view query results directly or affect IAM resources, which require higher privileges.
CVSS v3.1
Score 8.8high
Affected software
pkg:github/surrealdb/surrealdbRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
SurrealDB before version 1.5.5 and 2.0.0-beta before 2.0.0-beta.3 improperly validates objects passed to signin and signup RPC API operations. An unauthenticated attacker can craft a binary object using bincode serialization containing a subquery. This subquery executes within the context of the database owner's SIGNIN/SIGNUP query under a system user session with editor role privileges. This allows unauthorized modification and access to non-IAM resources, though IAM resources remain protected and query results are not directly exposed.
Potential Impact
An unauthenticated attacker can execute arbitrary subqueries with editor role privileges via the RPC API signin/signup operations. This enables unauthorized selection, creation, update, and deletion of non-IAM resources. The attacker cannot view query results directly and cannot affect IAM resources, which require owner role privileges. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability of affected resources.
Mitigation Recommendations
A fix is available in SurrealDB version 1.5.5 and later, and 2.0.0-beta.3 and later. Users should upgrade to these versions or newer to remediate this vulnerability. No additional mitigation steps are indicated in the advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-xw2c-hrr9-4xwr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2024-58362"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a5ba17f44ab8fbf7c789e65
Added to database: 07/18/2026, 15:53:35 UTC
Last enriched: 09/12/2026, 11:02:12 UTC
Last updated: 10/17/2026, 06:48:11 UTC
Views: 181
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.