CVE-2026-102876
SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal
CVSS
8.1
High
EPSS
0.3%
p18
KEV
—
Exploit Today
5
0-100
Published: Sep 29, 2026 · Last modified: Oct 2, 2026 · CWE-639
0.3%EPSS · 30 days0.3%
2026-09-302026-10-19
SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant's namespace and database to read, create, and modify records across tenant boundaries.
- github.comhttps://github.com/surrealdb/surrealdb
- github.comhttps://github.com/surrealdb/surrealdb/blob/v3.2.4/surrealdb/server/src/ntw/auth.rs
- github.comhttps://github.com/surrealdb/surrealdb/commit/5000e233b4a8b96689c82715c172061dcf711d31
- github.comhttps://github.com/surrealdb/surrealdb/releases/tag/v3.3.0
- github.comhttps://github.com/surrealdb/surrealdb/security/advisories/GHSA-vx2p-7hhm-wv62
- www.vulncheck.comhttps://www.vulncheck.com/advisories/surrealdb-before-3.3.0-cross-tenant-access-via-headers
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1140915.3 MED—
———Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker holding any tenant's API key who knows a victim's run friendlyId can replay that run into their own environment and read the victim's task payload.8hCVE-2026-1140795.4 MED—
———Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId only. Attackers with a dev, preview, or CI secret key can POST to the deployment cancel endpoint to cancel in-progress production deployments within the same project.8hCVE-2026-1140788.1 HIG—
———Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedule route with a victim schedule friendlyId to destroy other organizations' IMPERATIVE cron schedules.8hCVE-2026-1140777.1 HIG—
———Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deployment background-workers endpoint with a victim's deployment ID to re-point that in-progress deployment at a worker in the attacker's environment.8hCVE-2026-1140688.3 HIG—
———Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that run to block indefinitely on a waitpoint the victim cannot complete, and can inject resume data into it.8hCVE-2026-1140668.1 HIG—
———Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/batch with resumeParentOnCompletion to suspend, indefinitely block, or inject errors into production or cross-organization runs.8h