crates.io/surrealdb: high 8.8

SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers

Action: Upgrade surrealdb to 3.1.0 or later.

cargo update -p surrealdb --precise 3.1.0

Affected

Fixed versions

Sources

• osv: GHSA-5qfp-32cf-69jh
• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-5qfp-32cf-69jh
• https://github.com/surrealdb/surrealdb/commit/fd800fc7c55afcdc97057d18cf7cb7f83557e702
• https://github.com/surrealdb/surrealdb

published 2026-07-01T20:00:17Z · modified 2026-07-01T20:15:09.916892176Z · JSON