SurrealDB Namespace Isolation Bypass in Custom API Routes

SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in different namespaces/databases. Attackers with valid credentials for any namespace/database can access custom API endpoints in other tenants by specifying the target scope in the URL path, reading sensitive data or triggering unintended operations.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

SurrealDB versions before 3.2.0 contain a critical authorization flaw where custom API routes fail to properly validate namespace and database scope restrictions. This vulnerability allows authenticated users with valid credentials for one namespace or database to access API endpoints intended for other tenants by manipulating the URL path. The impact is significant because it enables unauthorized data access across tenant boundaries and execution of unintended operations—a classic privilege escalation scenario that violates multi-tenancy trust boundaries. Organizations using SurrealDB for multi-tenant deployments or shared database infrastructure are directly affected, particularly those relying on namespace/database segmentation for data isolation and access control.

Casky's 283 matched skills leverage Claude's extended reasoning to identify the attack patterns underlying this vulnerability across MITRE ATT&ACK tactics TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners would observe findings related to CWE-639 (Authorization Bypass Through User-Controlled Key) manifesting as: (1) authentication bypass signatures where valid credentials from one scope are used to access protected resources in another scope; (2) lateral movement indicators showing API requests with manipulated path parameters targeting cross-tenant endpoints; (3) data exfiltration patterns revealing unauthorized reads from unintended databases; and (4) privilege escalation chains where lower-privileged namespace access translates to higher-privileged operations. These skills help practitioners map observed API request anomalies, scope validation failures, and cross-tenant access attempts to this specific vulnerability pattern, enabling faster detection and response.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-63735.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-63735

Casky has 283 skills that investigate the attack patterns behind CVE-2026-63735. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn