SurrealDB versions before 2.1.0 have a denial of service vulnerability related to role conversion. (CVE-2024-58358)
SurrealDB versions before 2.1.0 have a denial of service vulnerability related to role conversion. Privileged owner users can define users with nonexistent roles, and when an attacker signs in with such a user, it triggers an uncaught panic that crashes the server. This vulnerability affects the stability of the database server by allowing a crash through invalid role assignments.
AI Analysis
Technical Summary
CVE-2024-58358 is a denial of service vulnerability in SurrealDB prior to version 2.1.0. The issue arises from the role conversion process where privileged owner users can assign nonexistent roles to users. When a user with an invalid role attempts to sign in, the server encounters an uncaught panic, resulting in a crash. This vulnerability is categorized under CWE-248 (Uncaught Exception). There is no indication of known exploits in the wild, and no patch or official fix information is provided in the available data.
Potential Impact
An attacker can cause a denial of service by triggering a server crash when signing in with a user assigned an invalid role. This disrupts availability of the SurrealDB server. The vulnerability requires privileged owner user capabilities to define such invalid roles, limiting the attack vector to users with high privileges. There is no evidence of data confidentiality or integrity impact from the provided information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict privileged owner user access to trusted administrators only to prevent creation of users with invalid roles. Monitor for updates from the SurrealDB vendor regarding an official fix.
SurrealDB versions before 2.1.0 have a denial of service vulnerability related to role conversion. (CVE-2024-58358)
Description
SurrealDB versions before 2.1.0 have a denial of service vulnerability related to role conversion. Privileged owner users can define users with nonexistent roles, and when an attacker signs in with such a user, it triggers an uncaught panic that crashes the server. This vulnerability affects the stability of the database server by allowing a crash through invalid role assignments.
CVSS v4.0
Affected software
pkg:github/surrealdb/surrealdbRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-58358 is a denial of service vulnerability in SurrealDB prior to version 2.1.0. The issue arises from the role conversion process where privileged owner users can assign nonexistent roles to users. When a user with an invalid role attempts to sign in, the server encounters an uncaught panic, resulting in a crash. This vulnerability is categorized under CWE-248 (Uncaught Exception). There is no indication of known exploits in the wild, and no patch or official fix information is provided in the available data.
Potential Impact
An attacker can cause a denial of service by triggering a server crash when signing in with a user assigned an invalid role. This disrupts availability of the SurrealDB server. The vulnerability requires privileged owner user capabilities to define such invalid roles, limiting the attack vector to users with high privileges. There is no evidence of data confidentiality or integrity impact from the provided information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict privileged owner user access to trusted administrators only to prevent creation of users with invalid roles. Monitor for updates from the SurrealDB vendor regarding an official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9qrf-6whp-92w3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2024-58358"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a5ba17f44ab8fbf7c789e96
Added to database: 07/18/2026, 15:53:35 UTC
Last enriched: 07/18/2026, 16:24:00 UTC
Last updated: 07/18/2026, 18:37:16 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.