Race Condition Affecting surrealdb package, versions <3.1.0-beta.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-SURREALDB-17797655
- published2 Jul 2026
- disclosed1 Jul 2026
- creditUnknown
Introduced: 1 Jul 2026
New CVE NOT AVAILABLE CWE-362 (opens in a new tab)How to fix?
Upgrade surrealdb to version 3.1.0-beta.1 or higher.
Overview
Affected versions of this package are vulnerable to Race Condition through the concurrent processing of authenticated and unauthenticated requests to the /rpc endpoint, which share mutable session state. An attacker can gain unauthorized access to privileged operations by sending unauthenticated requests in parallel with authenticated traffic, potentially inheriting the authenticated user's session and privileges. This is only exploitable if the attacker can send concurrent HTTP requests to the /rpc endpoint while a legitimate authenticated session is active.
Workaround
This vulnerability can be mitigated by restricting network access to the /rpc endpoint to trusted clients.