Live › vulnerability › CVE-2026-121418
SurrealDB from 3.1.0 before 3.3.0 lets record users read restricted fields indirectly, because the query planner uses indexes on fields they cannot SELECT. An attacker can run full-text, compound B-tree or HNSW vector queries to learn which records contain guessed values or nearest vectors.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Teams running SurrealDB 3.1.x or 3.2.x that expose record-level access where some fields are restricted by SELECT permissions but are indexed. Deployments without record users, or without indexes on restricted fields, are less exposed. The sources do not say more than this.
No product ranges from the sources yet.
surreal version; affected releases are 3.1.0 up to but not including 3.3.0.3.3.0 or later, per the vulnerability range in the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW KNN queries against restricted fields to learn which records contain guessed values or nearest vectors.
This page as .md · .json · in your agent: get_signal("CVE-2026-121418")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.