SurrealDB published 27 advisories with 4.0.0 on 2026-11-03: MCP session hijack CVE-2026-121419 (fixed 3.3.0), MCP identifier statement injection (fixed 4.0.0)

View raw markdownEdit on GitHub ↗

TL;DR

SurrealDB released 4.0.0 on 2026-11-03 and published 27 security advisories the same day on its GitHub tab, every one patched only in 4.0.0 and none with a CVE. The one CVE of the day, VulnCheck's CVE-2026-121419 (CVSS 4.0 8.6, 3.1 8.1), is for a different advisory: the MCP session hijack the vendor had published on 2026-10-19 and fixed in 3.3.0. On an MCP-over-HTTP deployment that authenticates users with a shared JWT or BEARER access method, any user of that method holding another user's mcp-session-id could run MCP tools with the victim's roles. Upgrade to 4.0.0 to get all of it. A 3.3.x release closes only the session hijack, and 3.2.6, published 2026-10-19, sits inside every affected range.

What happened

The CVE: MCP session hijack through a shared subject fingerprint. The vendor advisory GHSA-pgh9-49q4-hqcx (published 2026-10-19 by maintainer rushmorem, High, CVSS 3.1 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, reporter Yanhaoxi) says the MCP HTTP transport's per-request subject re-check builds its BoundSubject fingerprint from (level, session.au.id()), and for DEFINE ACCESS ... TYPE JWT or TYPE BEARER methods the actor id is the access method's name, the same for every user of that method, while the user/password path uses the per-user name. An attacker holding "a valid token for the same access method, even at the lowest role" and "the victim's mcp-session-id, which may leak through HTTP logs, proxies, or shared observability" passes the check and runs MCP tools on the victim's bound session with the victim's permissions, and audit logs attribute the activity to the victim. User/password authentication is not affected. The advisory says it was reproduced on the released 3.2.0 binary and on a 3.3.0-nightly commit. The vendor page's affected range reads >= 3.1.0, < 3.3.0 while its description says "SurrealDB >= 3.2.0". The CNA record settles on 3.1.0 before 3.3.0 and lists 3.3.0 as unaffected. VulnCheck published CVE-2026-121419 on 2026-11-03 (CVSS 4.0 8.6 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N, CWE-269), and the GitHub Advisory Database listed it as the first row of the mcp query the same day under a database-issued id, GHSA-hprh-85vv-3jpq, while the vendor advisory keeps its own id, GHSA-pgh9-49q4-hqcx, and printed "No known CVE" when read on 2026-11-04. A reader grepping either id should know the other.

The batch: 27 advisories dated 2026-11-03, none with a CVE. The vendor tab (11 pages) carries ten advisories dated 2026-11-03 on page 1, nine on page 2, seven on page 3 and one on page 4. Every one read says affected < 4.0.0, patched 4.0.0, no CVE, most credited to "ARSB". The session-hijack advisory of 2026-10-19 is not among them. The ones that matter to an agent operator:

  • GHSA-cr79-9p8r-p5wx (High): MCP tool identifier validation permits statement injection via escaped backticks. The MCP server's identifier validator treats the first backtick as the closing delimiter even when preceded by a backslash, while SurrealQL's parser reads a doubled backtick as an escaped literal. An identifier value passed to an MCP tool therefore breaks out of the quoted identifier and runs arbitrary SurrealQL, "bypassing the tool's argument constraints". The precondition is the ability to pass identifier values to the MCP tools, which for an agent means a prompt injection that reaches a tool argument.
  • GHSA-fq69-wr4w-v3gm (High): JavaScript query bridge bypasses the arbitrary-query subject gate. The embedded JavaScript surrealdb.query() bridge ran queries without checking Capabilities::allows_query(), so "a subject restricted to predefined operations can bypass policy and run arbitrary queries by executing a script it is permitted to run". Its sibling GHSA-5w6j-qm42-4rc2 (High) is the same gap for built-in function capabilities.
  • GHSA-7pqw-x84x-frxc (High): filesystem bucket containment fails to resolve descendant symlinks. The file-bucket store checked path.starts_with(root) lexically and canonicalized only the root, so a symlink already inside the bucket that points outside it lets get, put, copy, rename and list reach the host filesystem. The same fix commit covers Windows backslashes (GHSA-6c37-x4jm-529x, High) and direct-bucket keys crossing key-based ACL boundaries (GHSA-cph5-pm57-9w9c, High).
  • GHSA-q83r-f38r-rwvj (High): the Surrealism WASI socket allowlist ignores deny_net, SSRF through a hostname that resolves to a private address.
  • GHSA-p3c2-wh5f-jwqm (High): GraphQL WebSocket upgrade omits frame and message size limits.
  • Row- and field-permission bypasses rated Moderate or High: UNIQUE-index conflict errors, re-RELATE echoes, ON DELETE REJECT errors and REFERENCE cascades disclosing or writing past SELECT, update and delete permissions (GHSA-cff7-q66j-4hc8, GHSA-3rcm-c653-wgmr, GHSA-ff2q-h4x7-cpj4, GHSA-fh2q-8f75-m4h6), quoted computed-field formatting (GHSA-5xcv-fm6g-4hf3, High), FOR-loop variables named $auth, $access and $token shadowing the session values that permission expressions read (GHSA-ffvm-mqh3-7986), wildcard field-permission index drift (GHSA-wjh3-m4pv-q6cp), authenticated export permission bypass (GHSA-qh3v-rr48-x3cq), a model export route that redirects authenticated requests (GHSA-7r2m-g5wf-pj9j, High), the VIEWER role creating tables (GHSA-m887-2246-mgw3, Low), DDL bypassing the implicit-creation authorization added by an earlier fix (GHSA-3287-hpm5-3f8r), LIVE query notification side effects (GHSA-pvv9-h693-m8r4), computed-field update predicates evaluated before population (GHSA-f6h4-5xf2-86q9), and interactive transactions committing writes a THROWing event refused (GHSA-623g-mhxq-5hmf).
  • Memory-safety findings in "safe" Rust (an out-of-bounds read in surrealkv, an uninitialized read in surrealdb-parser, a data race and double free through reblessive 0.4.3: GHSA-9fm9-c4h4-8g93, GHSA-4p8w-qx5v-p6fc, GHSA-m9qr-4rcq-3jhc), a decimal-overflow crash (GHSA-g422-fj9r-m92g), and the CLI help output printing SURREAL_PASS and SURREAL_TOKEN values (GHSA-whfh-76h8-2r66, Low).

The release line. crates.io lists 3.3.0 on 2026-09-24 (the GitHub release page shows 28 Sep), 3.3.1 through 3.3.5 from 2026-10-07 to 2026-10-29, 3.2.6 on 2026-10-19, 4.0.0-beta.1 on 2026-10-28 and 4.0.0 on 2026-11-03. The 3.2.6 release went out the day the session-hijack advisory was published and is inside its < 3.3.0 range. Neither the advisory nor the CNA record names a 3.2.x backport, so treat 3.2.6 as affected. The 4.0.0 release page carries no notes, and the vendor blog's 4.0 announcement ("SurrealDB 4. The database and memory for every agent", 2026-11-03) is positioned at agents, which is the audience that connects it through MCP. The advisories published 2026-09-28 and 2026-10-19 on the same tab (two Critical cross-tenant header bugs, GHSA-w5v9-jc5f-5rmc and GHSA-vx2p-7hhm-wv62, among them) predate this batch and were not opened for this file.

Am I affected?

  1. Version: surreal version, or cargo tree -i surrealdb for embedded use. Anything below 4.0.0 is inside the 27 no-CVE advisories. 3.1.0 through 3.2.6 is inside CVE-2026-121419 as well. Scanners keyed on OSV will flag only the CVE range.
  2. MCP exposure: an MCP endpoint over HTTP (POST /mcp) is the surface for both MCP advisories. For the session hijack, check whether users authenticate with a DEFINE ACCESS ... TYPE JWT or TYPE BEARER method that more than one user shares. For the identifier injection, check whether an agent can pass table or field identifiers it took from untrusted content.
  3. Buckets: a filesystem bucket whose directory contains symlinks, or runs on Windows, is inside the traversal advisories.
  4. Embedded scripts: sessions that are allowed to run JavaScript functions but denied arbitrary queries were not actually denied.

If you are affected

  • Upgrade to 4.0.0. A 3.3.x upgrade closes the session hijack only.
  • Until then, for the session hijack, keep mcp-session-id out of proxy and HTTP logs and shared observability, or switch multi-user MCP access to user/password authentication. For the identifier injection, do not let model-chosen identifiers reach MCP tool arguments. For buckets, remove symlinks from the bucket directory.
  • If a shared-access-method MCP deployment was reachable by untrusted users, review audit logs knowing that a hijacked session is attributed to the victim.
  • See if an MCP server was malicious for the agent-side checklist and MCP hygiene.

Prevention

  • A database's MCP server is a query surface for the model. Keep it on a per-user credential, never a shared bearer, and scope the tools. See agent sandboxing.
  • Watch the vendor tab, not the CVE feed: none of these 27 advisories has a CVE and none will appear in a dependency scanner.

Sources