CVE-2026-121419

SurrealDB MCP sessions can confuse users of the same JWT access method

SurrealDB · MCP HTTP transport

First documented disclosure · Review checkpoint

Summary

A valid low-privilege token plus a victim session ID can run tools with the victim’s permissions.

Severity and exploitation evidence

High · 8.6/10 · CVSS 4.0. Severity source.

Exploitation not established: Reviewed disclosure and controlled research; malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

BoundSubject uses the access-method name as identity, so different JWT/Bearer users of that method pass the same session comparison.

Conditions required

MCP over HTTP, a shared JWT/Bearer access method, the attacker’s valid token and the victim’s mcp-session-id. Username/password authentication is not affected by this collision.

Potential impact

Cross-user data reads or modifications through the victim’s bound session; the researcher demonstrated viewer-to-editor escalation on a controlled server.

Affected versions and configurations

CNA and advisory table: >=3.1.0 and <3.3.0. Research body tested 3.2.0 and a 3.3.0 nightly; v2.x was not assessed.

Fix and mitigation status

3.3.0, according to the maintainer advisory.

Practical next steps

Upgrade to 3.3.0 or a later supported release. Protect session IDs and review shared JWT/Bearer MCP deployments and their audit trails.

Operating lesson

Bind each tool session to the individual principal, not merely the authentication method.

Evidence and limits

The maintainer published the advisory October 19; the CNA followed November 3. The 3.3.0 release is dated September 28. CNA 8.6 CVSS 4.0 differs from the maintainer’s 8.1 v3.1. A valid session-ID leak is a prerequisite, not a demonstrated component of an attack campaign.

Sources