SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted users, an unauthenticated attacker can encode a binary object containing a subquery using the bincode serialization format and supply it in place of credentials. The subquery is then executed within the database owner's SIGNIN/SIGNUP query under a system user session with the editor role, allowing the attacker to select, create, update, and delete non-IAM resources (though not view the query results directly, and not affect IAM resources, which require the owner role).
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
SurrealDB versions before 1.5.5 and 2.0.0-beta.3 contain a critical authentication bypass vulnerability in their RPC API signin and signup operations. The vulnerability stems from insufficient input validation on arbitrary objects passed to these endpoints—specifically, the platform fails to recursively validate for non-computed values before processing. When a record access method defines SIGNIN or SIGNUP queries, attackers can exploit this by encoding malicious binary objects using bincode serialization format and submitting them as credentials. This allows unauthenticated adversaries to inject subqueries that execute with unintended privileges, bypassing authentication controls entirely. Any organization exposing SurrealDB's RPC API to untrusted networks or users is at risk of unauthorized data access and potential lateral movement.
While this vulnerability doesn't map directly to existing MITRE ATT&CK techniques in current taxonomy, Casky's extended reasoning capabilities would identify attack patterns associated with CWE-75 (Path Traversal) class vulnerabilities and improper input validation leading to code injection scenarios. Practitioners using Casky would observe detection findings related to: (1) suspicious RPC API calls with serialized binary payloads to signin/signup endpoints, (2) authentication requests containing nested query structures or unusual object nesting patterns that deviate from expected credential formats, and (3) database query execution originating from unauthenticated sessions. The platform's 754 mapped security skills would highlight anomalous authentication patterns and unsafe deserialization practices, enabling security teams to identify exploitation attempts before credentials are compromised or unauthorized database queries execute.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2024-58362. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation