HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-102876 — SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construc...

·Source: NIST NVD

Updated:

Executive Summary

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant's namespace and database to read, cr

Analysis

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant's namespace and database to read, create, and modify records across tenant boundaries. CVSS Score: 8.1. Published: 2026-09-29T20:17:18.230.

Indicators of Compromise (1)

CVE (1)
CVE-2026-102876
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 29, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

YARA-X 1.21.0 Release, (Sat, Oct 3rd)

YARA-X&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s 1.21.0 release brings 5 improvements and 4 bugfixes.

SANS ISC
MEDIUMVulnerability

Danish university DTU breach exposes data of up to 200,000 people

The Technical University of Denmark (DTU) says information belonging to up to 200,000 users may have been exposed after hackers accessed its identity and access management system and downloaded a large amount of data. [...]

BleepingComputer
CRITICALVulnerability

DHS readies major cyber contract

Justin Doubleday reports: The Department of Homeland Security is preparing this year to award a major cloud, cybersecurity and network services contract aimed at further centralizing the management of IT services across DHS. In a notice posted to Sam.gov last month, DHS laid out the notional timeline for award of the Network, Cloud and Cybersecurity... Source

DataBreaches.net