Skip to main content

Over 150 LLM Providers · Over 5,300 Models The most extensible AI-powered pentesting platform. Open source. Star on GitHub

CVE-2026-63763

8.8 · HIGH
Published Jul 20, 2026 surrealdb CWE-639

Overview

CVE-2026-63763 is a high-severity vulnerability affecting surrealdb surrealdb. It was published on July 20, 2026 and has a CVSS 3.1 base score of 8.8 (HIGH).

This vulnerability has a CVSS 3.1 base score of 8.8, rated HIGH. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

Technical Description

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users (e.g., those with the database editor role) can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the invoking/querying user rather than their creator, an attacker can plant malicious logic that executes with a higher-privileged user's permissions when that user reads or writes the affected record. This can lead to full privilege escalation, including creation of a root owner and server takeover.

Remediation

Check the references section for vendor advisories and patches from surrealdb. Update surrealdb to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor Product Versions Status
surrealdb surrealdb >= 0, < 2.5.0 Affected

Frequently Asked Questions

What is CVE-2026-63763?

CVE-2026-63763 is a high-severity vulnerability affecting surrealdb surrealdb. It was published on July 20, 2026 and has a CVSS 3.1 base score of 8.8 (HIGH).

How severe is CVE-2026-63763?

This vulnerability has a CVSS 3.1 base score of 8.8, rated HIGH. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2026-63763?

Check the references section for vendor advisories and patches from surrealdb. Update surrealdb to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-63763?

CyberStrike's AI-powered security agents can automatically detect CVE-2026-63763 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

Browse by year 2026