SurrealDB before 3.3.0 Cross-Tenant Access via Headers

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-102876 · Microsoft / collected KEV context

cve-program · CVE-2026-102876

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-vx2p-7hhm-wv62
• https://github.com/surrealdb/surrealdb/commit/5000e233b4a8b96689c82715c172061dcf711d31
• https://github.com/surrealdb/surrealdb/blob/v3.2.4/surrealdb/server/src/ntw/auth.rs
• https://github.com/surrealdb/surrealdb/releases/tag/v3.3.0
• https://github.com/surrealdb/surrealdb
• https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-cross-tenant-access-via-headers

No related operational record is retained in the current change model.