---
id: 2026-11-surrealdb-4-0-0-day-twenty-seven-advisories-mcp-session-hijack-cve-2026-121419-fixed-3-3-0-mcp-identifier-injection-fixed-4-0-0
title: "SurrealDB published 27 advisories with 4.0.0 on 2026-11-03: MCP session hijack CVE-2026-121419 (fixed 3.3.0), MCP identifier statement injection (fixed 4.0.0)"
date_disclosed: 2026-11-03
last_updated: 2026-11-04
severity: high
status: patched
ecosystems: [surrealdb, rust, mcp, agent-memory, databases]
tools_affected: ["SurrealDB 3.1.0 through 3.2.x exposing MCP over HTTP with a JWT or BEARER access method shared by several users (CVE-2026-121419)", "every SurrealDB release before 4.0.0 for the 27 advisories published 2026-11-03 without a CVE, including the MCP tool identifier injection, the JavaScript query bridge capability bypass and the filesystem bucket symlink traversal", "agents that use SurrealDB as memory through its MCP server or the surrealdb crate"]
tags: [mcp, session-hijack, privilege-escalation, authentication, sql-injection, capability-bypass, path-traversal, vendor-batch, rust, agent-memory, vulncheck, patched]
---

## TL;DR
SurrealDB released 4.0.0 on 2026-11-03 and published 27 security advisories the same day on its GitHub tab, every one patched only in 4.0.0 and none with a CVE. The one CVE of the day, VulnCheck's CVE-2026-121419 (CVSS 4.0 8.6, 3.1 8.1), is for a different advisory: the MCP session hijack the vendor had published on 2026-10-19 and fixed in 3.3.0. On an MCP-over-HTTP deployment that authenticates users with a shared JWT or BEARER access method, any user of that method holding another user's `mcp-session-id` could run MCP tools with the victim's roles. Upgrade to 4.0.0 to get all of it. A 3.3.x release closes only the session hijack, and 3.2.6, published 2026-10-19, sits inside every affected range.

## What happened

**The CVE: MCP session hijack through a shared subject fingerprint.** The vendor advisory GHSA-pgh9-49q4-hqcx (published 2026-10-19 by maintainer rushmorem, High, CVSS 3.1 8.1 `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`, reporter Yanhaoxi) says the MCP HTTP transport's per-request subject re-check builds its `BoundSubject` fingerprint from `(level, session.au.id())`, and for `DEFINE ACCESS ... TYPE JWT` or `TYPE BEARER` methods the actor id is the access method's name, the same for every user of that method, while the user/password path uses the per-user name. An attacker holding "a valid token for the same access method, even at the lowest role" and "the victim's `mcp-session-id`, which may leak through HTTP logs, proxies, or shared observability" passes the check and runs MCP tools on the victim's bound session with the victim's permissions, and audit logs attribute the activity to the victim. User/password authentication is not affected. The advisory says it was reproduced on the released 3.2.0 binary and on a 3.3.0-nightly commit. The vendor page's affected range reads `>= 3.1.0, < 3.3.0` while its description says "SurrealDB `>= 3.2.0`". The CNA record settles on 3.1.0 before 3.3.0 and lists 3.3.0 as unaffected. VulnCheck published CVE-2026-121419 on 2026-11-03 (CVSS 4.0 8.6 `AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N`, CWE-269), and the GitHub Advisory Database listed it as the first row of the `mcp` query the same day under a database-issued id, GHSA-hprh-85vv-3jpq, while the vendor advisory keeps its own id, GHSA-pgh9-49q4-hqcx, and printed "No known CVE" when read on 2026-11-04. A reader grepping either id should know the other.

**The batch: 27 advisories dated 2026-11-03, none with a CVE.** The vendor tab (11 pages) carries ten advisories dated 2026-11-03 on page 1, nine on page 2, seven on page 3 and one on page 4. Every one read says affected `< 4.0.0`, patched 4.0.0, no CVE, most credited to "ARSB". The session-hijack advisory of 2026-10-19 is not among them. The ones that matter to an agent operator:

- **GHSA-cr79-9p8r-p5wx (High): MCP tool identifier validation permits statement injection via escaped backticks.** The MCP server's identifier validator treats the first backtick as the closing delimiter even when preceded by a backslash, while SurrealQL's parser reads a doubled backtick as an escaped literal. An identifier value passed to an MCP tool therefore breaks out of the quoted identifier and runs arbitrary SurrealQL, "bypassing the tool's argument constraints". The precondition is the ability to pass identifier values to the MCP tools, which for an agent means a prompt injection that reaches a tool argument.
- **GHSA-fq69-wr4w-v3gm (High): JavaScript query bridge bypasses the arbitrary-query subject gate.** The embedded JavaScript `surrealdb.query()` bridge ran queries without checking `Capabilities::allows_query()`, so "a subject restricted to predefined operations can bypass policy and run arbitrary queries by executing a script it is permitted to run". Its sibling GHSA-5w6j-qm42-4rc2 (High) is the same gap for built-in function capabilities.
- **GHSA-7pqw-x84x-frxc (High): filesystem bucket containment fails to resolve descendant symlinks.** The file-bucket store checked `path.starts_with(root)` lexically and canonicalized only the root, so a symlink already inside the bucket that points outside it lets `get`, `put`, `copy`, `rename` and `list` reach the host filesystem. The same fix commit covers Windows backslashes (GHSA-6c37-x4jm-529x, High) and direct-bucket keys crossing key-based ACL boundaries (GHSA-cph5-pm57-9w9c, High).
- **GHSA-q83r-f38r-rwvj (High):** the Surrealism WASI socket allowlist ignores `deny_net`, SSRF through a hostname that resolves to a private address.
- **GHSA-p3c2-wh5f-jwqm (High):** GraphQL WebSocket upgrade omits frame and message size limits.
- Row- and field-permission bypasses rated Moderate or High: UNIQUE-index conflict errors, re-RELATE echoes, ON DELETE REJECT errors and REFERENCE cascades disclosing or writing past SELECT, update and delete permissions (GHSA-cff7-q66j-4hc8, GHSA-3rcm-c653-wgmr, GHSA-ff2q-h4x7-cpj4, GHSA-fh2q-8f75-m4h6), quoted computed-field formatting (GHSA-5xcv-fm6g-4hf3, High), FOR-loop variables named `$auth`, `$access` and `$token` shadowing the session values that permission expressions read (GHSA-ffvm-mqh3-7986), wildcard field-permission index drift (GHSA-wjh3-m4pv-q6cp), authenticated export permission bypass (GHSA-qh3v-rr48-x3cq), a model export route that redirects authenticated requests (GHSA-7r2m-g5wf-pj9j, High), the VIEWER role creating tables (GHSA-m887-2246-mgw3, Low), DDL bypassing the implicit-creation authorization added by an earlier fix (GHSA-3287-hpm5-3f8r), LIVE query notification side effects (GHSA-pvv9-h693-m8r4), computed-field update predicates evaluated before population (GHSA-f6h4-5xf2-86q9), and interactive transactions committing writes a THROWing event refused (GHSA-623g-mhxq-5hmf).
- Memory-safety findings in "safe" Rust (an out-of-bounds read in `surrealkv`, an uninitialized read in `surrealdb-parser`, a data race and double free through `reblessive` 0.4.3: GHSA-9fm9-c4h4-8g93, GHSA-4p8w-qx5v-p6fc, GHSA-m9qr-4rcq-3jhc), a decimal-overflow crash (GHSA-g422-fj9r-m92g), and the CLI help output printing `SURREAL_PASS` and `SURREAL_TOKEN` values (GHSA-whfh-76h8-2r66, Low).

**The release line.** crates.io lists 3.3.0 on 2026-09-24 (the GitHub release page shows 28 Sep), 3.3.1 through 3.3.5 from 2026-10-07 to 2026-10-29, 3.2.6 on 2026-10-19, 4.0.0-beta.1 on 2026-10-28 and 4.0.0 on 2026-11-03. The 3.2.6 release went out the day the session-hijack advisory was published and is inside its `< 3.3.0` range. Neither the advisory nor the CNA record names a 3.2.x backport, so treat 3.2.6 as affected. The 4.0.0 release page carries no notes, and the vendor blog's 4.0 announcement ("SurrealDB 4. The database and memory for every agent", 2026-11-03) is positioned at agents, which is the audience that connects it through MCP. The advisories published 2026-09-28 and 2026-10-19 on the same tab (two Critical cross-tenant header bugs, GHSA-w5v9-jc5f-5rmc and GHSA-vx2p-7hhm-wv62, among them) predate this batch and were not opened for this file.

## Am I affected?

1. **Version:** `surreal version`, or `cargo tree -i surrealdb` for embedded use. Anything below 4.0.0 is inside the 27 no-CVE advisories. 3.1.0 through 3.2.6 is inside CVE-2026-121419 as well. Scanners keyed on OSV will flag only the CVE range.
2. **MCP exposure:** an MCP endpoint over HTTP (`POST /mcp`) is the surface for both MCP advisories. For the session hijack, check whether users authenticate with a `DEFINE ACCESS ... TYPE JWT` or `TYPE BEARER` method that more than one user shares. For the identifier injection, check whether an agent can pass table or field identifiers it took from untrusted content.
3. **Buckets:** a filesystem bucket whose directory contains symlinks, or runs on Windows, is inside the traversal advisories.
4. **Embedded scripts:** sessions that are allowed to run JavaScript functions but denied arbitrary queries were not actually denied.

## If you are affected

- Upgrade to 4.0.0. A 3.3.x upgrade closes the session hijack only.
- Until then, for the session hijack, keep `mcp-session-id` out of proxy and HTTP logs and shared observability, or switch multi-user MCP access to user/password authentication. For the identifier injection, do not let model-chosen identifiers reach MCP tool arguments. For buckets, remove symlinks from the bucket directory.
- If a shared-access-method MCP deployment was reachable by untrusted users, review audit logs knowing that a hijacked session is attributed to the victim.
- See [if an MCP server was malicious](../playbooks/if-an-mcp-server-was-malicious.md) for the agent-side checklist and [MCP hygiene](../prevention/mcp-hygiene.md).

## Prevention

- A database's MCP server is a query surface for the model. Keep it on a per-user credential, never a shared bearer, and scope the tools. See [agent sandboxing](../prevention/agent-sandboxing.md).
- Watch the vendor tab, not the CVE feed: none of these 27 advisories has a CVE and none will appear in a dependency scanner.

## Sources
- [CVE Services — CVE-2026-121419](https://cveawg.mitre.org/api/cve/CVE-2026-121419) — fetched 2026-11-04: VulnCheck CNA, published 2026-11-03 14:28 UTC, title, affected `pkg:cargo/surrealdb` 3.1.0 before 3.3.0, 3.3.0 unaffected, CVSS 4.0 8.6 and 3.1 8.1 with vectors, CWE-269, references, credit Yanhaoxi.
- [surrealdb/surrealdb — GHSA-pgh9-49q4-hqcx](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pgh9-49q4-hqcx) — fetched 2026-11-04: published 2026-10-19, the mechanism, conditions, reproduction note, the `>= 3.1.0` range beside the `>= 3.2.0` description, patched 3.3.0, "No known CVE".
- [surrealdb/surrealdb — GHSA-cr79-9p8r-p5wx](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-cr79-9p8r-p5wx), [GHSA-fq69-wr4w-v3gm](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-fq69-wr4w-v3gm), [GHSA-7pqw-x84x-frxc](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-7pqw-x84x-frxc) — fetched 2026-11-04: published 2026-11-03, affected `< 4.0.0`, patched 4.0.0, no CVE, the descriptions summarised above, credit ARSB.
- [surrealdb/surrealdb — security advisories tab, pages 1 to 4](https://github.com/surrealdb/surrealdb/security/advisories) — fetched 2026-11-04: the 27 rows dated 2026-11-03 with titles and severities, the 2026-10-19 and 2026-09-28 rows around them.
- [GitHub Advisory Database — `mcp` query, newest first](https://github.com/advisories?query=mcp+sort%3Apublished-desc) — fetched 2026-11-04: GHSA-hprh-85vv-3jpq / CVE-2026-121419 as the top row, High, 2026-11-03.
- [VulnCheck — advisories index](https://www.vulncheck.com/advisories) — fetched 2026-11-04: the 2026-11-03 and 2026-11-04 rows; the SurrealDB record is on page 2.
- [crates.io — surrealdb versions](https://crates.io/api/v1/crates/surrealdb/versions) — read 2026-11-04: the publish dates listed above, nothing yanked.
- [surrealdb/surrealdb — release v4.0.0](https://github.com/surrealdb/surrealdb/releases/tag/v4.0.0) and [v3.3.0](https://github.com/surrealdb/surrealdb/releases/tag/v3.3.0) — fetched 2026-11-04: 4.0.0 dated 03 Nov with no notes body, 3.3.0 dated 28 Sep with no notes body.
- [SurrealDB — blog index](https://surrealdb.com/blog) — fetched 2026-11-04: the 2026-11-03 "SurrealDB 4" announcement title; no post mentions the advisories.
- Related in this corpus: [the August MCP server CVE batch](2026-08-agent-framework-mcp-cve-batch.md) for the DBHub database-MCP entries with the same no-auth-plus-browser shape.