Summary
SurrealDB can fail to enforce that a caller-selected namespace or database matches the scope at which an authenticated system user logged in. An authenticated attacker may then access or alter data in another tenant when the target tables permit the requested operations.
SurrealDB can fail to enforce that a caller-selected namespace or database matches the scope at which an authenticated system user logged in. An authenticated attacker may then access or alter data in another tenant when the target tables permit the requested operations.
Affected context
The issue affects SurrealDB deployments using namespace- or database-level system-user authentication when requests can select a namespace or database through the Surreal-NS and Surreal-DB headers or the RPC use method. Risk depends on the target tenant's table permissions and on whether an authenticated user can submit such requests.
The issue affects SurrealDB deployments using namespace- or database-level system-user authentication when requests can select a namespace or database through the Surreal-NS and Surreal-DB headers or the RPC use method. Risk depends on the target tenant's table permissions and on whether an authenticated user can submit such requests.
Exploit preconditions
- Attack surface: The SQL endpoint or RPC interface that accepts caller-selected namespace and database context
- Required access: Valid authentication for a namespace- or database-level system user
- Trigger point: Supplying a different namespace or database through request context selection
- Why exploitation is possible: The server does not adequately bind the selected tenant context to the authentication scope before applying table permissions
- Attack surface: The SQL endpoint or RPC interface that accepts caller-selected namespace and database context
- Required access: Valid authentication for a namespace- or database-level system user
- Trigger point: Supplying a different namespace or database through request context selection
- Why exploitation is possible: The server does not adequately bind the selected tenant context to the authentication scope before applying table permissions
Why this happens
The underlying bug is an authorization-context validation failure. SurrealDB accepts a caller-selected namespace or database without consistently verifying that it is within the scope established when the system user authenticated. This maps to CWE-639: Authorization Bypass Through User-Controlled Key, because user-controlled tenant identifiers influence access decisions without sufficient authorization checks.
The underlying bug is an authorization-context validation failure. SurrealDB accepts a caller-selected namespace or database without consistently verifying that it is within the scope established when the system user authenticated. This maps to CWE-639: Authorization Bypass Through User-Controlled Key, because user-controlled tenant identifiers influence access decisions without sufficient authorization checks.
Potential impact
- An authenticated user may read rows belonging to another tenant
- An attacker could create, modify, or delete records where target table permissions allow those operations
- DEFINE PARAM values from another tenant may be exposed
- Tenant isolation could be weakened, potentially causing data disclosure or integrity loss
- Cross-tenant activity could complicate auditing and incident response
- An authenticated user may read rows belonging to another tenant
- An attacker could create, modify, or delete records where target table permissions allow those operations
- DEFINE PARAM values from another tenant may be exposed
- Tenant isolation could be weakened, potentially causing data disclosure or integrity loss
- Cross-tenant activity could complicate auditing and incident response
General mitigation guidance
Mitigation generally focuses on binding authorization decisions to the authenticated tenant context rather than trusting caller-selected namespace or database values.
Common defensive patterns include:
- Enforcing server-side checks that the requested namespace and database are within the authenticated user's authorization scope
- Treating tenant identifiers from headers and RPC parameters as untrusted input
- Using secure-by-default session contexts that cannot be broadened by the caller
- Applying least privilege to system users and limiting cross-tenant administrative capabilities
- Reviewing table permissions so that tenant context is required for every sensitive operation
- Preserving audit records that include authenticated identity and effective namespace and database
Mitigation generally focuses on binding authorization decisions to the authenticated tenant context rather than trusting caller-selected namespace or database values.
Common defensive patterns include:
- Enforcing server-side checks that the requested namespace and database are within the authenticated user's authorization scope
- Treating tenant identifiers from headers and RPC parameters as untrusted input
- Using secure-by-default session contexts that cannot be broadened by the caller
- Applying least privilege to system users and limiting cross-tenant administrative capabilities
- Reviewing table permissions so that tenant context is required for every sensitive operation
- Preserving audit records that include authenticated identity and effective namespace and database
How teams detect issues like this
Organizations can look for this class of issue through:
- Authorization tests that attempt to select namespaces or databases outside the authenticated scope
- Static and code review checks for user-controlled tenant identifiers used directly in access decisions
- Policy enforcement requiring explicit server-side binding between identity, namespace, and database
- Integration tests covering both SQL and RPC request paths
- Audit monitoring for authenticated identities accessing unexpected tenant contexts
- Automated security testing tools that model cross-tenant authorization boundaries
Organizations can look for this class of issue through:
- Authorization tests that attempt to select namespaces or databases outside the authenticated scope
- Static and code review checks for user-controlled tenant identifiers used directly in access decisions
- Policy enforcement requiring explicit server-side binding between identity, namespace, and database
- Integration tests covering both SQL and RPC request paths
- Audit monitoring for authenticated identities accessing unexpected tenant contexts
- Automated security testing tools that model cross-tenant authorization boundaries
