Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| surrealdb | rust | < 3.1.0 | 3.1.0 |
Miggo AIRoot Cause AnalysisThe vulnerability in SurrealDB (GHSA-whwg-vh4f-pmmf) consists of two distinct but related issues. The primary and most severe issue is an improper authorization vulnerability. When a user deleted a graph node, the subsequent automatic deletion of connected edges, handled by the surrealdb::doc::purge::Document::purge_edges function, was executed with all permission checks disabled. This was caused by the use of .with_perms(false) in the internal call to delete the edges. As a result, an attacker with permission to delete a node could also delete any edges connected to it, completely bypassing any PERMISSIONS FOR delete rules defined on the edge's table. The patch rectifies this by removing the .with_perms(false) call, ensuring that the cascading edge deletions are subject to the same permission checks as a direct deletion.
The second issue is an information disclosure vulnerability related to historical queries (i.e., queries using the VERSION clause). The query planner, specifically in the surrealdb::exec::planner::source::Planner::try_fast_path_pair function, would incorrectly decide to use a 'fast path' optimization for these queries based on the current table permissions, rather than the permissions that were in effect at the historical version being queried. This fast path would skip reading the edge record itself, thereby bypassing any historical row-level PERMISSIONS FOR select clauses on the edge table. This allowed an attacker to observe edge data that should have been hidden from them. The fix prevents this by disabling this fast path optimization whenever a VERSION clause is present, forcing the query to take a slower path that correctly evaluates historical permissions. Several scan operators (GraphEdgeScan, IndexScan, etc.) also had their execute methods patched to correctly resolve version timestamps, preventing similar permission bypasses.
surrealdb::doc::purge::Document::purge_edgessurrealdb/core/src/doc/purge.rs
surrealdb::exec::planner::source::Planner::try_fast_path_pairsurrealdb/core/src/exec/planner/source.rs
surrealdb::exec::operators::scan::graph::GraphEdgeScan::executesurrealdb/core/src/exec/operators/scan/graph.rs
surrealdb::exec::operators::scan::index::IndexScan::executesurrealdb/core/src/exec/operators/scan/index.rs
surrealdb::exec::operators::scan::record_id::RecordIdScan::executesurrealdb/core/src/exec/operators/scan/record_id.rs