Live › vulnerability › CVE-2026-121419
SurrealDB versions 3.1.0 before 3.3.0 bind MCP sessions to the access method name instead of the individual user for JWT and Bearer logins. An attacker with any valid low-privilege token for the same access method, plus a victim's mcp-session-id, can run MCP tools with the victim's roles and permissions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Teams running SurrealDB 3.1.0 through 3.2.x with the MCP endpoint exposed to JWT or Bearer authenticated users. Deployments on versions before 3.1.0 or 3.3.0 and later are outside the stated range, and deployments that do not use the MCP interface with these access methods are less exposed.
No product ranges from the sources yet.
surreal version; affected range is 3.1.0 to before 3.3.0.3.3.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's mcp-session-id can hijack the session and execute MCP tools with the victim's roles and permissions.
This page as .md · .json · in your agent: get_signal("CVE-2026-121419")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.