CVE-2025-11060mediumCWE-863

CVE-2025-11060: medium-severity vulnerability in surrealdb

Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions

Published · Updated

Follow this CVE+ Monitor surrealdb+ Monitor OpenShift Service Mesh

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.7epss 0.3%
A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected products
surrealdbRed Hat · OpenShift Service Mesh 3
Related CVEs — surrealdb

In the same product, most dangerous first.

CVE-2025-8556LOWGithub.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect resultsEPSS 0.5%CVE-2026-89091HIGHAnsible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code executionEPSS 0.5%CVE-2026-11332HIGHAnsible-core: argument injection in ansible-galaxy role install leads to arbitrary code executionEPSS 0.2%CVE-2026-123037MEDIUMAnsible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)EPSS 0.1%