External risk intelligence

SurrealDB RPC Session Race Condition Privilege Escalation.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-63756

The vulnerability exists in the HTTP /rpc endpoint of a database product. Database servers and their associated RPC interfaces are frequently exposed to the network to support application connectivity, and this specific endpoint is designed to process web-based requests, making it a common target for network-based interaction.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in SurrealDB that could allow unauthenticated attackers to hijack user sessions and execute operations with elevated privileges by exploiting a race condition in the HTTP /rpc endpoint. The concern lies in the potential for unauthorized access and actions if this database technology is in use and exposed to external networks.

Unauthenticated users can take over sessions.
It impacts systems using SurrealDB's RPC endpoint.
Confirm relevance and exposure for this database.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted, concurrent requests to the system's HTTP RPC endpoint. This timing attack targets a race condition that occurs when the system is processing legitimate authenticated traffic, potentially allowing the attacker to hijack an active session and execute operations with the privileges of an authenticated user without needing any credentials.

Network access required.
Exploits a timing flaw in RPC endpoint.
Leads to unauthorized actions.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute database operations with the privileges of an authenticated user. This is possible when the SurrealDB HTTP /rpc endpoint is accessed concurrently by both legitimate authenticated traffic and malicious unauthenticated requests.

Authenticated session state could be inherited.
Concurrent requests to the /rpc endpoint could cause the issue.
Unauthorized access to data or execution of commands.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in SurrealDB's HTTP /rpc endpoint requires immediate attention to prevent unauthorized access and privilege escalation. The first practical step is to identify all instances of the affected SurrealDB deployment, determine their network reachability and criticality to business operations, and then confirm the accountable owner for remediation. This process will enable a risk-based approach to planning and executing the necessary updates or mitigations.

Identify affected SurrealDB instances and owners.
Verify network exposure and business criticality.
Plan and execute timely remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SurrealDB?

SurrealDB is a multi-model, cloud-native database designed for modern applications. It combines document, graph, relational, and vector data storage into a single engine, offering a flexible API for web and mobile development. It is often used as a backend for complex applications that require real-time data synchronization and complex querying capabilities across different data structures.

What is the weakness in CVE-2026-63756?

This vulnerability is classified as a Time-of-Check to Time-of-Use (CWE-362) race condition. In simple terms, the database software has a small window during request processing where it fails to properly distinguish between an unauthenticated request and an active, legitimate session. Because the system checks for authentication at one moment but uses the session state a split second later, an attacker can slip in a malicious request that inherits the privileges of an existing, authorized user.

How is this race condition triggered?

An attacker triggers this by sending high-concurrency requests to the database's HTTP /rpc endpoint at the exact same time legitimate users are interacting with the system. It is not triggered by a single static request or a simple login attempt; it requires the precise timing of malicious traffic overlapping with valid, authenticated operations. If the endpoint is idle and no authorized sessions are active, this specific race condition cannot be successfully exploited.

How do I know if this is a risk for my infrastructure?

According to Halo Surface Signal, the risk depends heavily on how your database is deployed. Because this flaw resides in the HTTP /rpc endpoint—a component often exposed to facilitate connectivity for web applications—any SurrealDB instance accessible over a public network is at significantly higher risk. You should prioritize assessing systems where this RPC interface is reachable from the internet or untrusted network segments.

What is the first step to address CVE-2026-63756?

Start by identifying all instances of SurrealDB within your environment to see which ones are running versions prior to 3.1.0. Once you have a list of affected servers, map them to their specific business purpose and determine whether they are exposed to external networks. After identifying the owners of these critical systems, coordinate a schedule to apply the vendor-provided update, which resolves the handling of session states during concurrent RPC calls.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.