CVE-2026-109342

5.4Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.4Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-306

Impact

Attackers can forcibly invalidate other users' refresh tokens to trigger a denial of service and force re-authentication. They need network access to the RPC interface and grant IDs obtained either via low-privileged VIEWER access or leaked tokens.

Root cause

The revoke RPC method fails to enforce authentication or verify token ownership before invalidating refresh tokens.

Affected systems

SurrealDB from 3.0.0 before 3.3.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Fix & remediation

Upgrade SurrealDB to version 3.3.0 or later. If upgrading cannot happen immediately, restrict network access to the SurrealDB RPC endpoint to trusted clients.

shell

$ surreal version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession. Attackers can obtain grant identifiers via ACCESS SHOW ALL with VIEWER permission or leaked tokens, then permanently revoke refresh tokens to force re-authentication.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109342