{"items":[{"id":"NVI-00017481","kind":"vulnerability","title":"SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-5qfp-32cf-69jh"],"plain_summary":"GitHub lists this reviewed advisory for surrealdb. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-088c05c78b84bcaa9b0adfffdcb5e65a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-01T20:00:18.000Z","value":"8.8 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-088c05c78b84bcaa9b0adfffdcb5e65a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-088c05c78b84bcaa9b0adfffdcb5e65a","url":"https://github.com/advisories/GHSA-5qfp-32cf-69jh","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-5qfp-32cf-69jh","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T03:49:14.191Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-088c05c78b84bcaa9b0adfffdcb5e65a"],"technology":"surrealdb","known_exclusions":[],"conditions_summary":"The HTTP `/rpc` `sessions` method returned every attached session UUID without authentication, and the `/rpc` handler accepted an arbitrary `session` field with no ownership check. An anonymous caller could enumerate UUIDs and impersonate any authenticated session.\n\n\"Attached\" means sessions registered via `{\"method\":\"attach\"}` — the only writer to the HTTP session map. Ordinary stateless `/rpc` requests use ephemeral per-request sessions that are filtered from `sessions()` and destroyed at end-of-request, so they are not enumerable.\n\n### Exposure\n\n- **Exposed:** clients that issue `attach`, notably the official Rust SDK's `Http`/`Https` engine (auto-attaches once per `Surreal` handle).\n- **Not exposed:** REST endpoints (`/sql`, `/key`, `/signin`, `/export`, etc.); WebSocket `/rpc` (per-connection scope, `attach` refused); embedded / MCP usage; ad-hoc `POST /rpc` callers that never `attach`.\n\n### Impact\n\nFor each **attached and authenticated** session, an unauthenticated attacker can read, write, and delete any data the session can reach, dump metadata, invalidate sessions, and escalate to that session's privilege level (up to root). An attached session that has not yet authenticat","public_affected_ranges":["< 3.1.0"]}],"null_published_at":"2026-11-05T19:10:21.395Z","source_updated_at":"2026-07-01T20:00:18.000Z","source_disclosed_at":"2026-07-01T20:00:17.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T03:49:14.191Z"}],"next_cursor":null,"snapshot_revision":"42594"}