CVE-2026-121416: fallo de gravedad alta en surrealdb
SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.3%
SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax, e.g. [1,2].map() or $f.put()/$f.get() to write and read file bucket data despite file::* denials.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
surrealdb · surrealdbCVEs relacionadas — surrealdb
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-58368HIGHSurrealDB before 1.1.0 Denial of Service via HTTP HeadersEPSS 0.7%CVE-2024-58362HIGHSurrealDB before 1.5.5 Query Injection via RPC APIEPSS 0.6%CVE-2024-58366CRITICALSurrealDB before 1.1.1 Format String via Scripting FunctionsEPSS 0.6%CVE-2025-71391HIGHSurrealDB before 2.2.2 Denial of Service via /sql endpointEPSS 0.6%CVE-2025-71397HIGHSurrealDB before 2.2.2 CPU Exhaustion via nested FOR loopsEPSS 0.6%CVE-2025-71396LOWSurrealDB before 2.2.2 Denial of Service via JavaScript ScriptingEPSS 0.6%