Live › vulnerability › CVE-2026-121416
SurrealDB 2.0.0 before 3.3.1 does not apply --deny-funcs restrictions to method-style function calls, because the method evaluation path skips the capability check. An authenticated user who can submit queries can run functions the operator denied, such as writing and reading file bucket data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Teams running a SurrealDB server that relies on --deny-funcs to restrict functions for query users. The flaw needs a user who can submit queries; servers without denied functions or with only trusted users are less exposed. unknown for the full version range beyond 2.0.0 before 3.3.1.
No product ranges from the sources yet.
surreal version and compare with the fixed release in the sources.--deny-funcs (for example file::*) in the startup command or config.3.3.1 or later (sources state the fix is in versions from 3.3.1).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax, e.g. [1,2].map() or $f.put()/$f.get() to write and read file bucket data despite file::* denials.
This page as .md · .json · in your agent: get_signal("CVE-2026-121416")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.