SurrealDB < 3.1.5 Information Disclosure via ORDER BY

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-63309 · Microsoft / collected KEV context

EUVD-2026-45215

GHSA-2f98-6626-h2p2

GHSA-h4h3-3rfj-x6fq

cve-program · CVE-2026-63309

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h4h3-3rfj-x6fq
• https://github.com/surrealdb/surrealdb/releases/tag/v3.1.5
• https://www.vulncheck.com/advisories/surrealdb-information-disclosure-via-order-by

euvd · EUVD-2026-45215

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h4h3-3rfj-x6fq
• https://github.com/surrealdb/surrealdb/releases/tag/v3.1.5
• https://www.vulncheck.com/advisories/surrealdb-information-disclosure-via-order-by

nvd · CVE-2026-63309

• https://github.com/surrealdb/surrealdb/releases/tag/v3.1.5
• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h4h3-3rfj-x6fq
• https://www.vulncheck.com/advisories/surrealdb-information-disclosure-via-order-by

osv · GHSA-2f98-6626-h2p2

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h4h3-3rfj-x6fq
• https://nvd.nist.gov/vuln/detail/CVE-2026-63309
• https://github.com/surrealdb/surrealdb/releases/tag/v3.1.5
• https://www.vulncheck.com/advisories/surrealdb-information-disclosure-via-order-by

osv · GHSA-h4h3-3rfj-x6fq

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h4h3-3rfj-x6fq
• https://github.com/surrealdb/surrealdb

• SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field · Advisory content revised · 4 Nov 2026