Listen to this Post
SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes. The vulnerability exists in the routing mechanism for the `/api/{namespace}/{database}/{endpoint}` endpoint. When a request is made to this route, the system extracts the namespace and database directly from the URL path and applies them to the caller’s session before the endpoint is looked up or executed. Critically, it performs this operation without verifying that the caller’s authenticated scope actually covers the target namespace and database.
An authenticated user with valid credentials for any single namespace or database—even with the minimal `VIEWER` permission—can exploit this by simply naming a victim’s scope in the URL. The custom API handler (defined via DEFINE API) runs with permissions disabled (definer’s rights). As a result, the endpoint’s own `PERMISSIONS` clause becomes the only access control gate; a `PERMISSIONS FULL` endpoint is effectively open to everyone, and even `PERMISSIONS NONE` tables can be read because permissions are disabled during handler execution. The `api::invoke()` function is affected in the same manner, resolving against the session’s selected namespace and database, which can be set via the surreal-ns/surreal-db headers or `USE` statements.
This is not an unauthenticated bypass; an attacker still needs valid credentials for some namespace or database on the instance. However, in multi-tenant deployments where namespace/database boundaries are relied upon for tenant isolation, a single compromised credential can lead to cross-tenant data access and unauthorized operations. The vulnerability is rooted in a missing authorization check within the API routing layer, where user-provided scope parameters are accepted without proper validation against the authenticated session context. The patch, included in SurrealDB 3.2.0, now validates the namespace and database against the caller’s authenticated level before the endpoint is resolved or run. Requests targeting a scope outside that level are rejected with a 403 Forbidden.
DailyCVE Form:
Platform: SurrealDB
Version: <3.2.0
Vulnerability: Auth Bypass
Severity: High (8.1)
Date: 2026-07-20
Prediction: Already Patched (2026-07-20)
What Undercode Say:
Check current SurrealDB version
surreal version
Identify vulnerable endpoints - list all custom APIs
curl -X GET http://localhost:8000/api/ --header "Authorization: Bearer <token>"
Test for cross-tenant access (requires valid credentials for any namespace)
Attempt to access a custom API in a different tenant's namespace
curl -X GET http://localhost:8000/api/victim_ns/victim_db/some_endpoint \
--header "Authorization: Bearer <token_from_any_tenant>"
The api::invoke() function is also affected - can be called with target scope
SurrealQL query demonstrating the issue
USE NS attacker_ns DB attacker_db;
RETURN api::invoke("victim_ns", "victim_db", "some_endpoint", {});
Exploit: (Educational Purposes!)
- Obtain valid credentials for any namespace/database on the target SurrealDB instance (e.g., `attacker_ns/attacker_db` with `VIEWER` permissions).
- Identify a target custom API endpoint in another tenant’s scope (e.g.,
victim_ns/victim_db/sensitive_endpoint). - Craft an HTTP request to the vulnerable route:
GET /api/victim_ns/victim_db/sensitive_endpoint. - Include the valid authentication token obtained in step 1 in the `Authorization` header.
- The server will accept the `namespace` and `database` from the URL, apply them to the session, and execute the endpoint without verifying the caller’s scope.
- Because the handler runs with permissions disabled, any data returned by the endpoint—including from `PERMISSIONS NONE` tables—can be read.
- The same technique works for the `api::invoke()` function by passing the victim scope as arguments.
Protection:
- Upgrade: Immediately upgrade to SurrealDB version 3.2.0 or later. The patch (
fix(core/api): reject cross-tenant custom API access) is included in this release. - Disable Custom API Routes: If the custom API HTTP route is not required, disable it via capabilities.
- Rethink Isolation: On shared instances, treat separate deployments as the tenant isolation boundary rather than relying solely on namespace/database boundaries.
- Strengthen Permissions: Where possible, use a `PERMISSIONS WHERE` clause that explicitly checks the authenticated identity (e.g.,
$auth.id) instead ofPERMISSIONS FULL. Note that this reduces exposure but does not fully restore the isolation boundary. - Monitor: Log and monitor for unusual `api::invoke()` calls or requests to `/api/{namespace}/{database}/{endpoint}` with unexpected scope parameters.
Impact:
- Cross-Tenant Data Access: An attacker with valid credentials for any single namespace can read data from custom API endpoints in other tenants’ namespaces and databases.
- Data Exfiltration: The attacker can read sensitive data returned by the endpoint, including from tables with
PERMISSIONS NONE, as the handler runs with permissions disabled. - Unauthorized Operations: The attacker can trigger any writes and side effects that the custom API endpoint performs, potentially leading to data corruption or unauthorized modifications.
- Multi-Tenant Isolation Breakdown: In multi-tenant deployments where namespace/database boundaries are the primary isolation mechanism, this vulnerability completely breaks tenant isolation.
- Limited Scope: The attack cannot reach a scope without valid credentials for some namespace/database on the instance; it is not an unauthenticated bypass. Single-tenant deployments and deployments where callers already hold instance-wide (root) scope are not affected.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
