6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-wp87-mgvq-5j93

GHSA-wp87-mgvq-5j93: SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization

An anonymous caller could create new namespaces and databases on a running SurrealDB instance without holding DEFINE NAMESPACE or DEFINE DATABASE permission.

USE NS <name> and USE DB <name> automatically create the target when it does not exist. The three places USE is handled — the RPC use method, Datastore::process_use, and the SurrealQL executor — did not check whether the caller was allowed to create the resource. Under default capabilities any session reached this path, including an unauthenticated guest.

Impact

What an attacker can do:

Create new namespaces and databases without DEFINE NAMESPACE / DEFINE DATABASE permission. An unauthenticated guest is enough under default capabilities.
Recreate a parent namespace that an operator deliberately dropped, using a stale namespace-Editor token, by running USE NS <dropped> DB anything.
Exhaust catalog storage by repeatedly creating new resources.

What it can't do:

Read or modify data inside any pre-existing namespace or database.
Escalate to root or namespace-owner privileges on existing resources.
Affect deployments running with auth_enabled=false.

Patches

All three USE entry points now check whether the caller has DEFINE NAMESPACE / DEFINE DATABASE authority before creating a missing target. Sessions still update their context regardless of authorization, so SDKs that send use before signin continue to work — only the catalog creation step is gated. The parent-namespace side-effect path is closed by the same check.

Versions 3.1.0 and later are not affected.

Workarounds

Set --deny-arbitrary-query * for guest principals to remove the entry point.
Run with --auth and require all callers to signin before issuing use.
Revoke namespace-level tokens promptly when a namespace is dropped.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-wp87-mgvq-5j93

GHSA-wp87-mgvq-5j93:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
surrealdb	rust	< 3.1.0	3.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-wp87-mgvq-5j93, allowed unauthorized creation of namespaces and databases in SurrealDB. The core of the issue was that the USE NS <name> and USE DB <name> commands were designed to automatically create the specified resource if it didn't exist. However, the logic for this implicit creation failed to check if the session had the necessary DEFINE NAMESPACE or DEFINE DATABASE permissions.

This flaw was present in all three primary code paths that handle the USE command:

The RPC handler (surrealdb::core::rpc::protocol::RpcProtocol::handle), which processes requests from clients.
The Datastore::process_use method (surrealdb::core::kvs::ds::Datastore::process_use), used by internal components and embedded SDKs.
The SurrealQL query executor (surrealdb::core::dbs::executor::Executor::execute), which handles raw SQL statements.

In all three locations, the code would proceed to create the resources without any authorization check. This meant that an unauthenticated guest user could connect to a SurrealDB instance and create an arbitrary number of namespaces and databases, potentially leading to resource exhaustion or interfering with legitimate database administration.

The patch addresses this by introducing authorization checks at each of these three entry points. Before attempting to create a namespace or database, the code now verifies that the session has the equivalent of DEFINE permissions. This ensures that implicit creation via the USE command is governed by the same security policy as explicit DEFINE statements, effectively closing the authorization bypass.

Vulnerable functions

surrealdb::core::rpc::protocol::RpcProtocol::handle

surrealdb/core/src/rpc/protocol.rs

This function is the entry point for handling RPC requests. When processing a `USE` command, it would automatically create a namespace or database if it didn't exist, without checking if the caller had the necessary permissions. This allowed any user, including unauthenticated ones, to create resources.

surrealdb::core::kvs::ds::Datastore::process_use

surrealdb/core/src/kvs/ds.rs

This function, used by components like the embedded SDK, processes `USE` commands. It was vulnerable because it would implicitly create namespaces and databases without verifying the session's authorization, allowing unauthenticated resource creation.

surrealdb::core::dbs::executor::Executor::execute

surrealdb/core/src/dbs/executor.rs

This function is responsible for executing SurrealQL statements. When it processed a `USE` statement, it would create the specified namespace or database if it did not exist, without checking for `DEFINE` permissions. This allowed any user to create these resources via a simple SQL query.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.