CVE-2024-58362
CVE-2024-58362 is a high-severity vulnerability in Surrealdb with a CVSS 3.x base score of 8.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-75.
Key facts
- Severity: High (CVSS 3.x base score 8.8)
- CVSS v4: 8.7
- EPSS exploit prediction: 0% (31st percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-75
- Affected product: Surrealdb
- Published:
- Last modified:
Description
SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted users, an unauthenticated attacker can encode a binary object containing a subquery using the bincode serialization format and supply it in place of credentials. The subquery is then executed within the database owner's SIGNIN/SIGNUP query under a system user session with the editor role, allowing the attacker to select, create, update, and delete non-IAM resources (though not view the query results directly, and not affect IAM resources, which require the owner role).
Frequently asked questions
- What is CVE-2024-58362?
- SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted users, an unauthenticated attacker can encode a binary object containing a subquery using the bincode serialization format and supply it in place of credentials. The subquery is then executed within the database owner's SIGNIN/SIGNUP query under a system user session with the editor role, allowing the attacker to select, create, update, and delete non-IAM resources (though not view the query results directly, and not affect IAM resources, which require the owner role).
- How severe is CVE-2024-58362?
- CVE-2024-58362 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2024-58362 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (31st percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-58362?
- CVE-2024-58362 primarily affects Surrealdb. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2024-58362?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2024-58362 published?
- CVE-2024-58362 was published on 2026-07-18 and last updated on 2026-08-12.
References
- https://github.com/surrealdb/surrealdb/security/advisories/GHSA-64f8-pjgr-9wmr
- https://www.vulncheck.com/advisories/surrealdb-before-query-injection-via-rpc-api
Affected products (3)
- cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*
- cpe:2.3:a:surrealdb:surrealdb:2.0.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:surrealdb:surrealdb:2.0.0:beta2:*:*:*:*:*:*
More vulnerabilities in Surrealdb
- CVE-2026-63763 — High (CVSS 8.8): SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability.…
- CVE-2026-63757 — High (CVSS 8.8): SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns…
- CVE-2025-71390 — High (CVSS 8.8): SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames…
- CVE-2023-54366 — High (CVSS 8.8): SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and…
- CVE-2024-58366 — High (CVSS 8.5): SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when…
- CVE-2026-63756 — High (CVSS 8.1): SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that…
All CVEs affecting Surrealdb →
Other CWE-75 vulnerabilities
- CVE-2026-29042 — Critical (CVSS 9.8): Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell…
- CVE-2025-50213 — Critical (CVSS 9.8): Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow…
- CVE-2024-35373 — Critical (CVSS 9.8): Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php.
- CVE-2021-22910 — Critical (CVSS 9.8): A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an…
- CVE-2021-22911 — Critical (CVSS 9.8): A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to…
- CVE-2026-31908 — Critical (CVSS 9.1): Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in…