CVE-2026-63735: 
NixOS vulnerability analysis and mitigation

CVE-2026-63735 is an authorization bypass vulnerability in SurrealDB affecting all versions before 3.2.0, where custom API routes fail to validate namespace and database scope against the caller's authenticated session. Discovered and disclosed on July 20, 2026, the flaw allows authenticated users to invoke custom API endpoints (DEFINE API) belonging to other tenants by specifying an arbitrary namespace/database in the URL path. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, VulnCheck Advisory).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-862 (Missing Authorization). The vulnerable route /api/{namespace}/{database}/{endpoint} accepted the namespace and database values directly from the URL path and applied them to the caller's session before performing any authorization check, meaning the caller's authenticated scope was never validated against the requested target scope. Because custom API handlers run with permissions disabled (definer's rights), a PERMISSIONS FULL endpoint was fully accessible to any authenticated caller regardless of their actual tenant. The api::invoke() function was similarly affected, as it resolved against the session's selected namespace/database, which could be overridden via surreal-ns/surreal-db headers or a USE statement (GitHub Advisory).

An attacker with valid credentials for any namespace/database on a shared SurrealDB instance — even a low-privilege VIEWER account — can read sensitive data returned by another tenant's custom API endpoints, including data from PERMISSIONS NONE tables (since the handler runs with permissions disabled), and can trigger any writes or side effects those endpoints perform. This effectively breaks multi-tenant isolation enforced by namespace/database boundaries, enabling cross-tenant data exfiltration and unauthorized data modification. Single-tenant deployments and deployments where all callers hold instance-wide (root) scope are not affected (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). CISA's SSVC assessment classifies exploitation as "none" and the attack as non-automatable with partial technical impact. The EPSS score is approximately 0.26%, placing it in the 18th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported by Thai Son Dinh from VinSOC Labs (R&D), credited as sondt99 (GitHub Advisory).

1. Obtain valid credentials: Acquire any valid credentials for a SurrealDB instance running a version before 3.2.0 — even a low-privilege VIEWER account on any namespace/database is sufficient.
2. Enumerate target namespaces/databases: Identify the names of other namespaces and databases on the shared instance through documentation, error messages, or other reconnaissance methods.
3. Identify target custom API endpoints: Determine the names of custom API endpoints (DEFINE API) defined in the target namespace/database, particularly those with PERMISSIONS FULL.
4. Craft a cross-tenant HTTP request: Send an authenticated HTTP request to the vulnerable route, substituting the victim tenant's namespace and database in the URL path: GET /api/{victim_namespace}/{victim_database}/{target_endpoint}.
5. Alternatively, override via headers: Use the surreal-ns and surreal-db HTTP headers or a USE statement to set the session's namespace/database to the victim tenant's scope before calling api::invoke().
6. Exfiltrate data or trigger operations: The endpoint executes with definer's rights (permissions disabled), returning sensitive data or performing writes/side effects in the victim tenant's scope (GitHub Advisory).

• Network: HTTP requests to /api/{namespace}/{database}/{endpoint} where the namespace/database in the URL does not match the authenticated user's assigned namespace/database; unusual cross-tenant API calls from a single authenticated session.
• Logs: SurrealDB access logs showing a single user credential accessing multiple distinct namespace/database combinations via the custom API route; requests to /api/ paths with varying namespace/database segments from the same source IP or session token.
• Behavior: Authenticated sessions with low-privilege (VIEWER) accounts making requests to custom API endpoints in namespaces/databases they are not provisioned for; unexpected data reads or writes in tenant namespaces not associated with the authenticated user.

Upgrade SurrealDB to version 3.2.0 or later, which validates the requested namespace/database against the caller's authenticated level before resolving or executing any custom API endpoint, rejecting out-of-scope requests with a 403 Forbidden response (GitHub Advisory). For users unable to patch immediately, the following workarounds are recommended: (1) disable the custom API HTTP route via SurrealDB capabilities where it is not required; (2) treat separate SurrealDB deployments — rather than namespace/database boundaries — as the tenant isolation boundary on shared instances; (3) replace PERMISSIONS FULL with a PERMISSIONS WHERE clause that explicitly checks the authenticated identity to reduce exposure. Reviewing access logs to identify potential prior exploitation is also advised.

The vulnerability was reported by Thai Son Dinh from VinSOC Labs (R&D) and acknowledged by the SurrealDB team, who published a detailed security advisory on July 2, 2026 (GitHub Advisory). A Bluesky post from cyberhub.blog referencing the CVE was observed on July 22, 2026, indicating some community awareness. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified.