CVE-2024-58362

SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted users, an unauthenticated attacker can encode a binary object containing a subquery using the bincode serialization format and supply it in place of credentials. The subquery is then executed within the database owner's SIGNIN/SIGNUP query under a system user session with the editor role, allowing the attacker to select, create, update, and delete non-IAM resources (though not view the query results directly, and not affect IAM resources, which require the owner role).

Scoring

Severity

HIGH

CVSS base score

8.8

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS probability

0.64%

CWE

CWE-75

Published

2026-07-18

Last modified

2026-07-28

Affected products

• surrealdb surrealdb
• surrealdb surrealdb
• surrealdb surrealdb
• surrealdb surrealdb
• surrealdb surrealdb
• surrealdb surrealdb

Weakness type

• CWE-75

Related vulnerabilities

• CVE-2026-54771 — Langroid: handle_message() executes user-supplied tool JSON without sender verification
• CVE-2026-31908 — Apache APISIX: forward auth plugin allows header injection
• CVE-2026-29042 — Nuclio Shell Runtime Command Injection Leading to Privilege Escalation
• CVE-2026-27120 — Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster
• CVE-2025-61911 — python-ldap has sanitization bypass in ldap.filter.escape_filter_chars
• CVE-2025-50213 — Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator
• CVE-2024-9940 — Calculated Fields Form <= 5.2.45 - HTML Injection
• CVE-2023-1758 — Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in thorsten/phpmyfaq

Markdown version · Browse all CVEs