CVE-2026-63735
1 advisory.
crates.io/surrealdb CVE-2026-63735: high 8.1, EPSS 0.37%
SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path
Action: Upgrade surrealdb to 3.2.0 or later.
cargo update -p surrealdb --precise 3.2.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.2.0 | - |
Fixed versions
| 3.2.0 |
Sources
- osv: GHSA-848m-r628-vrxw
- https://github.com/surrealdb/surrealdb/security/advisories/GHSA-848m-r628-vrxw
- https://nvd.nist.gov/vuln/detail/CVE-2026-63735
- https://github.com/surrealdb/surrealdb/commit/0938f88d196dc4eb11a82af343df3fffe9c195e2
- https://github.com/surrealdb/surrealdb/commit/75b7154f84904d047619b5a47b08d256254dceca
- https://github.com/surrealdb/surrealdb
- https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-custom-api
CVE-2026-63735 · published · modified · JSON