A critical race condition in SurrealDB, prior to version 3.1.0, permits unauthenticated attackers to achieve unauthorized privilege escalation.

This vulnerability is a race condition (CWE-362) occurring within the RPC session management logic. It allows an unauthenticated attacker to manipulate shared resources during session establishment, leading to unauthorized privilege escalation.

Successful exploitation of this flaw allows an unauthenticated attacker to gain elevated privileges within the database environment. This could lead to full administrative control, unauthorized data access, and compromise of the underlying data integrity. Given the CVSS score of 8.1, the potential for high impact on confidentiality, integrity, and availability is significant for any organization utilizing SurrealDB as a core data store.

Immediate Action: Upgrade SurrealDB to version 3.1.0 or later immediately to resolve the synchronization flaw.

Proactive Monitoring: Review database access logs for unusual session establishment patterns or unexpected administrative actions originating from unauthenticated sources.

Compensating Controls: Implement strict network access controls to limit exposure of the SurrealDB interface to trusted hosts only, reducing the attack surface.

Public Exploit Available: No

The severity of this privilege escalation vulnerability necessitates immediate action. Administrators must prioritize updating all SurrealDB instances to version 3.1.0 to eliminate the race condition and secure the database environment against potential exploitation.