Summary
SurrealDB before 3.3.0 may allow an authenticated user from one tenant to construct an HTTP session targeting another tenant's namespace and database. Because authorization is checked against one set of headers while session context is taken from another, an attacker could read, create, or modify records across tenant boundaries.
Affected context
The issue occurs in HTTP session construction when SurrealDB uses separate headers for authentication and for selecting the active namespace and database. Deployments that rely on tenant-specific namespaces or databases may be exposed when the authenticated identity is not independently authorized for the namespace and database selected in the session request.
Exploit preconditions
- Attack surface: SurrealDB HTTP session or API endpoints that accept authentication and tenant-selection headers
- Required access: Valid credentials for at least one tenant or user account
- Trigger point: Session construction using namespace and database selection headers
- Why exploitation is possible: Authentication validates the
Surreal-Auth-NSandSurreal-Auth-DBvalues, while the session may use differentSurreal-NSandSurreal-DBvalues without a corresponding authorization check
Why this happens
The underlying flaw is a mismatch between the context used for credential verification and the context used to construct the authenticated session. This creates a confused-deputy authorization pattern: the system confirms that credentials are valid in one tenant context but applies the resulting session to another context selected by the request. The behavior maps to CWE-639: Authorization Bypass Through User-Controlled Key, because user-controlled identifiers influence access to protected tenant resources without adequate permission validation.
Potential impact
- An authenticated user may read records belonging to another tenant
- An attacker could create or modify cross-tenant records
- Tenant isolation guarantees may be weakened or bypassed
- Confidential business data could be exposed or altered
- Data integrity, compliance, and trust boundaries could be affected
General mitigation guidance
Mitigation generally focuses on binding authentication and authorization decisions to one validated tenant context.
Common defensive patterns include:
- Deriving the active namespace and database from the authenticated identity or a trusted server-side mapping
- Validating authorization for every requested namespace and database before constructing a session
- Treating tenant-selection headers as untrusted input rather than authoritative identity context
- Enforcing deny-by-default tenant isolation and least-privilege permissions
- Using centralized policy checks that cover both authentication context and requested resource
- Avoiding reliance on client-controlled headers for security-critical tenant selection
How teams detect issues like this
Organizations can look for authorization decisions that validate one resource identifier but use another identifier during session or request processing.
Useful approaches include:
- Static analysis and code review for mismatched authentication and resource-selection parameters
- Tests that authenticate in one tenant and request access to another tenant's namespace or database
- Policy checks requiring authorization for every user-controlled tenant identifier
- API gateway or service-mesh logging that correlates authenticated tenant context with selected namespace and database
- Automated security testing for cross-tenant read, create, update, and delete operations
